{"record":{"id":"94ccda8f51ebaa84","repo":"spring-projects/spring-security","slug":"server-error-94ccda","errorCode":"SERVER_ERROR","errorMessage":"The token generator failed to generate the authorization code.","messagePattern":"The token generator failed to generate the authorization code\\.","errorType":"error_code","errorClass":"OAuth2AuthorizationCodeRequestAuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationConsentAuthenticationProvider.java","lineNumber":242,"sourceCode":"\t\t\tthrow createException(OAuth2ErrorCodes.ACCESS_DENIED, OAuth2ParameterNames.CLIENT_ID,\n\t\t\t\t\tauthorizationConsentAuthentication, registeredClient, authorizationRequest);\n\t\t}\n\n\t\tOAuth2AuthorizationConsent authorizationConsent = authorizationConsentBuilder.build();\n\t\tif (currentAuthorizationConsent == null || !authorizationConsent.equals(currentAuthorizationConsent)) {\n\t\t\tthis.authorizationConsentService.save(authorizationConsent);\n\t\t\tif (this.logger.isTraceEnabled()) {\n\t\t\t\tthis.logger.trace(\"Saved authorization consent\");\n\t\t\t}\n\t\t}\n\n\t\tOAuth2TokenContext tokenContext = createAuthorizationCodeTokenContext(authorizationConsentAuthentication,\n\t\t\t\tregisteredClient, authorization, authorizedScopes);\n\t\tOAuth2AuthorizationCode authorizationCode = this.authorizationCodeGenerator.generate(tokenContext);\n\t\tif (authorizationCode == null) {\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"The token generator failed to generate the authorization code.\", ERROR_URI);\n\t\t\tthrow new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);\n\t\t}\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Generated authorization code\");\n\t\t}\n\n\t\tOAuth2Authorization updatedAuthorization = OAuth2Authorization.from(authorization)\n\t\t\t.authorizedScopes(authorizedScopes)\n\t\t\t.token(authorizationCode)\n\t\t\t.attributes((attrs) -> attrs.remove(OAuth2ParameterNames.STATE))\n\t\t\t.build();\n\t\tthis.authorizationService.save(updatedAuthorization);\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Saved authorization\");\n\t\t}\n\n\t\tString redirectUri = authorizationRequest.getRedirectUri();","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationConsentAuthenticationProvider.java#L224-L260","documentation":"In OAuth2AuthorizationConsentAuthenticationProvider.authenticate (the consent approval step of the authorization code flow), after recording consent the provider generates a new authorization code via the OAuth2AuthorizationCodeGenerator. If generation yields null, it throws OAuth2AuthorizationCodeRequestAuthenticationException with this SERVER_ERROR message, aborting the redirect back to the client.","triggerScenarios":"The user approves consent (POST to /oauth2/authorize) and the provider must mint a fresh authorization code, but the authorization code generator bean is absent, misconfigured, or a custom implementation returns null for the context.","commonSituations":"Same as the authorization-request variant: custom generator returning null, removed default generator bean, or broken delegation in a composite generator when customizing the authorization server.","solutions":["Register the default OAuth2AuthorizationCodeGenerator or include it in your generator chain.","Fix any custom OAuth2AuthorizationCodeGenerator so it returns a non-null OAuth2AuthorizationCode for consent-derived contexts.","Verify createAuthorizationCodeTokenContext inputs (authorization, scopes) are populated so the generator recognizes the context.","Revert recent authorization server config customizations to the defaults and re-apply incrementally."],"exampleFix":"// before\nclass MyCodeGenerator implements OAuth2TokenGenerator<OAuth2AuthorizationCode> {\n    public OAuth2AuthorizationCode generate(OAuth2TokenContext ctx) { return null; }\n}\n\n// after\nclass MyCodeGenerator implements OAuth2TokenGenerator<OAuth2AuthorizationCode> {\n    public OAuth2AuthorizationCode generate(OAuth2TokenContext ctx) {\n        return new OAuth2AuthorizationCode(Base64.getUrlEncoder().withoutPadding()\n            .encodeToString(SecureRandom.getInstanceStrong().generateSeed(32)),\n            Instant.now().plus(5, ChronoUnit.MINUTES));\n    }\n}","handlingStrategy":"try-catch","validationCode":"OAuth2AuthorizationCode code = authorizationCodeGenerator.generate(consentCodeContext);\nif (code == null) {\n    throw new IllegalStateException(\"Consent flow cannot mint authorization code; check generator bean\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // POST /oauth2/authorize (consent approval)\n} catch (OAuth2AuthorizationCodeRequestAuthenticationException ex) {\n    if (OAuth2ErrorCodes.SERVER_ERROR.equals(ex.getError().getErrorCode())) {\n        log.error(\"Consent approved but code generation failed: {}\", ex.getError().getDescription());\n    }\n    throw ex;\n}","preventionTips":["Include consent flow in integration tests whenever the token generator chain changes","Keep the default authorization code generator wired into both authorization-request and consent providers","Verify createAuthorizationCodeTokenContext receives a populated authorization and scopes"],"tags":["oauth2","consent","authorization-code","token-generation"],"backgroundTag":"missing-configuration","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}