{"record":{"id":"8e3849492fc59d75","repo":"apereo/cas","slug":"unsupported-response-type","errorCode":"unsupported_response_type","errorMessage":"Unsupported response_type: [%s]","messagePattern":"Unsupported response_type: \\[(.+?)\\]","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/authorization/BaseOAuth20AuthorizationRequestValidator.java","lineNumber":168,"sourceCode":"        if (!OAuth20Utils.checkCallbackValid(registeredService, redirectUri)) {\n            LOGGER.warn(\"Redirect URI [{}] found in the request is not authorized for registered service [{}].\",\n                redirectUri, registeredService.getServiceId());\n            setErrorDetails(context, OAuth20Constants.INVALID_REQUEST,\n                String.format(\"Redirect URI [%s] found in the request is not authorized for this service\", redirectUri), false);\n            return false;\n        }\n        return true;\n    }\n\n    private boolean verifyResponseType(final WebContext context, final String responseType) {\n        if (StringUtils.isBlank(responseType)) {\n            setErrorDetails(context, OAuth20Constants.UNSUPPORTED_RESPONSE_TYPE,\n                String.format(\"Missing required parameter: [%s]\", OAuth20Constants.RESPONSE_TYPE), true);\n            return false;\n        }\n\n        if (!OAuth20Utils.checkResponseTypes(responseType, OAuth20ResponseTypes.values())) {\n            LOGGER.warn(\"Response type [{}] is not found in the list of supported values [{}].\",\n                responseType, OAuth20ResponseTypes.values());\n            setErrorDetails(context, OAuth20Constants.UNSUPPORTED_RESPONSE_TYPE,\n                String.format(\"Unsupported response_type: [%s]\", responseType), true);\n\n            return false;\n        }\n        return true;\n    }\n\n}\n","sourceCodeStart":150,"sourceCodeEnd":179,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/authorization/BaseOAuth20AuthorizationRequestValidator.java#L150-L179","documentation":"The /authorize request must carry a response_type that CAS recognizes (code, token, id_token, device_code, etc., from OAuth20ResponseTypes). When the response_type parameter is missing or is not one of the supported enum values, CAS rejects the request with error=unsupported_response_type. The first branch of verifyResponseType handles a missing parameter; this message covers a present-but-unknown value.","triggerScenarios":"GET /oauth2.0/authorize?response_type=codes (typo) or response_type=code_token (unsupported combination) or any response_type outside OAuth20ResponseTypes.values().","commonSituations":"Typo in the client's authorization URL; client library emits OpenID hybrid values (e.g. code id_token) while the CAS build lacks the OIDC module; custom response types from another provider carried over during migration.","solutions":["Send a supported response_type such as code (authorization code flow) exactly as specified by the OAuth2 spec.","If you need OIDC response types (id_token, code id_token), enable the CAS OIDC support module and use the /oidcAuthorize endpoint.","Fix typos in the client's authorization request URL (e.g. response_type=code, not response_type=codes).","Verify the request parameter name is response_type and that the request-parameter resolver is reading it (custom resolvers may drop it)."],"exampleFix":"// before\nGET /cas/oauth2.0/authorize?client_id=app&redirect_uri=...&response_type=code_token\n// after\nGET /cas/oauth2.0/authorize?client_id=app&redirect_uri=...&response_type=code","handlingStrategy":"validation","validationCode":"const SUPPORTED = ['code','token','id_token','device_code'];\nif (!SUPPORTED.includes(responseType)) {\n  throw new Error(`Unsupported response_type: ${responseType}`);\n}","typeGuard":"const isSupportedResponseType = (v) => ['code','token','id_token','device_code'].includes(v);","tryCatchPattern":null,"preventionTips":["Centralize the authorization URL builder in one function with response_type=code hardcoded unless you specifically need another flow.","Add a startup-time assertion in the client that its configured flow maps to a supported response_type.","Avoid copying response_type values from other IdPs' documentation without checking CAS's OAuth20ResponseTypes enum."],"tags":["oauth","response-type","unsupported-enum-value","authorization-request"],"backgroundTag":"unsupported-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}