{"record":{"id":"5f87a8f13f0c1481","repo":"spring-projects/spring-security","slug":"invalid-scope","errorCode":"invalid_scope","errorMessage":"OpenID Connect 1.0 authentication requests are restricted.","messagePattern":"OpenID Connect 1\\.0 authentication requests are restricted\\.","errorType":"error_code","errorClass":"OAuth2AuthorizationCodeRequestAuthenticationException","httpStatus":400,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java","lineNumber":373,"sourceCode":"\t\t\t\t\t\t\t\t\t((Authentication) authorizationCodeRequestAuthentication.getPrincipal())\n\t\t\t\t\t\t\t\t\t\t.getPrincipal());\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\t\telse {\n\t\t\t// OpenID Connect is disabled.\n\t\t\t// Add an authentication validator that rejects authentication requests.\n\t\t\tConsumer<OAuth2AuthorizationCodeRequestAuthenticationContext> oidcAuthenticationRequestValidator = (\n\t\t\t\t\tauthenticationContext) -> {\n\t\t\t\tOAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication = authenticationContext\n\t\t\t\t\t.getAuthentication();\n\t\t\t\tif (authorizationCodeRequestAuthentication.getScopes().contains(OidcScopes.OPENID)) {\n\t\t\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_SCOPE,\n\t\t\t\t\t\t\t\"OpenID Connect 1.0 authentication requests are restricted.\",\n\t\t\t\t\t\t\t\"https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1\");\n\t\t\t\t\tthrow new OAuth2AuthorizationCodeRequestAuthenticationException(error,\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthentication);\n\t\t\t\t}\n\t\t\t};\n\t\t\tOAuth2AuthorizationEndpointConfigurer authorizationEndpointConfigurer = getConfigurer(\n\t\t\t\t\tOAuth2AuthorizationEndpointConfigurer.class);\n\t\t\tauthorizationEndpointConfigurer\n\t\t\t\t.addAuthorizationCodeRequestAuthenticationValidator(oidcAuthenticationRequestValidator);\n\t\t\tOAuth2PushedAuthorizationRequestEndpointConfigurer pushedAuthorizationRequestEndpointConfigurer = getConfigurer(\n\t\t\t\t\tOAuth2PushedAuthorizationRequestEndpointConfigurer.class);\n\t\t\tif (pushedAuthorizationRequestEndpointConfigurer != null) {\n\t\t\t\tpushedAuthorizationRequestEndpointConfigurer\n\t\t\t\t\t.addAuthorizationCodeRequestAuthenticationValidator(oidcAuthenticationRequestValidator);\n\t\t\t}\n\t\t}\n\n\t\tList<RequestMatcher> requestMatchers = new ArrayList<>();\n\t\tthis.configurers.values().forEach((configurer) -> {\n\t\t\tconfigurer.init(httpSecurity);","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java#L355-L391","documentation":"When OpenID Connect 1.0 is not enabled on the authorization server, the configurer installs an authentication request validator that rejects any authorization code request whose scope set contains 'openid'. It throws OAuth2AuthorizationCodeRequestAuthenticationException with code 'invalid_scope', since OIDC requests are only permitted when the OidcConfigurer is registered.","triggerScenarios":"A client sends an authorization request with scope 'openid' (e.g. scope=openid profile) to an authorization server configured with OAuth2AuthorizationServerConfigurer but WITHOUT .oidc(Customizer.withDefaults()) in the init(HttpSecurity) configuration.","commonSituations":"Developers following plain OAuth2 setup guides whose OIDC clients (spring-boot oidc login, keycloak-style clients) still request the 'openid' scope; enabling OIDC client side but not on the server; after refactoring that removed the .oidc() customizer.","solutions":["Enable OpenID Connect 1.0 on the server: add .oidc(Customizer.withDefaults()) to the OAuth2AuthorizationServerConfigurer in your SecurityFilterChain.","Alternatively remove 'openid' from the client's requested scopes if OIDC behavior (id_token) is not needed.","Ensure the configurer's init is applied via http.applyer http.with(authorizationServerConfigurer, customizer) so the validator is registered where intended.","Check for a duplicate/separate filter chain that handles /oauth2/authorize without the OIDC configurer."],"exampleFix":"// before\nOAuth2AuthorizationServerConfigurer authorizationServer = new OAuth2AuthorizationServerConfigurer();\nhttp.with(authorizationServer, Customizer.withDefaults());\n// after\nOAuth2AuthorizationServerConfigurer authorizationServer = new OAuth2AuthorizationServerConfigurer();\nauthorizationServer.oidc(Customizer.withDefaults());\nhttp.with(authorizationServer, Customizer.withDefaults());","handlingStrategy":"validation","validationCode":"// Server side: fail fast at startup if clients need OIDC\nAssert.state(\n    oidcRequired == false || authorizationServerConfigurer.getOidc() != null,\n    \"Clients request the 'openid' scope but OIDC is not enabled; call .oidc(withDefaults())\");\n\n// Client side: strip openid scope when OIDC is not enabled\nList<String> scopes = requestedScopes.stream()\n    .filter(s -> !\"openid\".equals(s))\n    .collect(Collectors.toList());","typeGuard":null,"tryCatchPattern":"try {\n    authorizeUri = client.authorizeUrl(state, scopes);\n} catch (OAuth2AuthorizationCodeRequestAuthenticationException e) {\n    if (\"invalid_scope\".equals(e.getError().getErrorCode())) {\n        // retry without the 'openid' scope or enable OIDC on the server\n    } else {\n        throw e;\n    }\n}","preventionTips":["Enable .oidc(Customizer.withDefaults()) whenever any client requests 'openid'.","Keep client-registered scopes aligned with server capabilities.","Add an integration test that performs an authorization request with scope=openid.","Document in your security config whether the server is OAuth2-only or OIDC-capable."],"tags":["oauth2","oidc","spring-security","scope"],"backgroundTag":"invalid-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}