{"record":{"id":"9cf81c667567bb40","repo":"spring-projects/spring-security","slug":"invalid-request-9cf81c","errorCode":"invalid_request","errorMessage":"OAuth 2.0 Parameter: client_id","messagePattern":"OAuth 2\\.0 Parameter: client_id","errorType":"error_code","errorClass":"OAuth2AuthorizationCodeRequestAuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationEndpointFilter.java","lineNumber":491,"sourceCode":"\t\t\t\tauthorizationCodeRequestAuthentication.setDetails(\n\t\t\t\t\t\tOAuth2AuthorizationEndpointFilter.this.authenticationDetailsSource.buildDetails(request));\n\n\t\t\t\tRegisteredClient registeredClient = this.registeredClientRepository\n\t\t\t\t\t.findByClientId(authorizationCodeRequestAuthentication.getClientId());\n\t\t\t\tif (registeredClient == null) {\n\t\t\t\t\tString redirectUri = null; // Prevent redirect\n\t\t\t\t\tOAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthenticationResult = new OAuth2AuthorizationCodeRequestAuthenticationToken(\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthentication.getAuthorizationUri(),\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthentication.getClientId(),\n\t\t\t\t\t\t\t(Authentication) authorizationCodeRequestAuthentication.getPrincipal(), redirectUri,\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthentication.getState(),\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthentication.getScopes(),\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthentication.getAdditionalParameters());\n\n\t\t\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST,\n\t\t\t\t\t\t\t\"OAuth 2.0 Parameter: \" + OAuth2ParameterNames.CLIENT_ID,\n\t\t\t\t\t\t\t\"https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1\");\n\t\t\t\t\tthrow new OAuth2AuthorizationCodeRequestAuthenticationException(error,\n\t\t\t\t\t\t\tauthorizationCodeRequestAuthenticationResult);\n\t\t\t\t}\n\n\t\t\t\tOAuth2AuthorizationCodeRequestAuthenticationContext authenticationContext = OAuth2AuthorizationCodeRequestAuthenticationContext\n\t\t\t\t\t.with(authorizationCodeRequestAuthentication)\n\t\t\t\t\t.registeredClient(registeredClient)\n\t\t\t\t\t.build();\n\n\t\t\t\tthis.authenticationValidator.accept(authenticationContext);\n\n\t\t\t\tReflectionUtils.setField(this.setValidatedField, authorizationCodeRequestAuthentication, true);\n\n\t\t\t\t// Set the validated authorization code request as a request\n\t\t\t\t// attribute\n\t\t\t\t// to be used upstream by OAuth2AuthorizationEndpointFilter\n\t\t\t\trequest.setAttribute(OAuth2AuthorizationCodeRequestAuthenticationToken.class.getName(),\n\t\t\t\t\t\tauthorizationCodeRequestAuthentication);\n","sourceCodeStart":473,"sourceCodeEnd":509,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationEndpointFilter.java#L473-L509","documentation":"This OAuth2AuthorizationCodeRequestAuthenticationException with invalid_request is thrown by OAuth2AuthorizationEndpointFilter's authorization code flow when the registered client cannot be resolved for the request's client_id — specifically the error description names the client_id OAuth 2.0 parameter. Per RFC 6749 section 4.1.2.1, a missing/unresolvable client_id makes the authorization request invalid.","triggerScenarios":"An authorization request (GET /oauth2/authorize) whose client_id has no matching RegisteredClient in the RegisteredClientRepository, or where the client_id parameter is absent/invalid at the point of context building.","commonSituations":"Client not registered (missing registeredClient bean or DB row); typo in client_id; authorization request built without client_id; repository lookup fails between provider checks.","solutions":["Verify the client_id in the authorization request matches a RegisteredClient in your RegisteredClientRepository","Register the client (createRegisteredClient / repository entry) before initiating the flow","Check the authorize URL is constructed with the correct client_id parameter","Ensure the RegisteredClientRepository bean points at the right store (in-memory vs JDBC)"],"exampleFix":"// before: client not registered\n// GET /oauth2/authorize?response_type=code&client_id=unknown-client\n// after: register the client first\nRegisteredClient client = RegisteredClient.withId(UUID.randomUUID().toString())\n    .clientId(\"known-client\").clientAuthenticationMethod(ClientAuthenticationMethod.NONE)\n    .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)\n    .redirectUri(\"https://app/cb\").build();\nrepository.save(client);","handlingStrategy":"validation","validationCode":"// Before redirecting the user to /oauth2/authorize\nboolean registered = registeredClientRepository.findByClientId(clientId) != null;\nif (!registered) throw new IllegalArgumentException(\"Unknown client_id: \" + clientId);","typeGuard":"boolean isKnownClient(String clientId, RegisteredClientRepository repo) {\n    return clientId != null && !clientId.isBlank() && repo.findByClientId(clientId) != null;\n}","tryCatchPattern":"try {\n    // server-side: intercept the exception from the authorize endpoint\n} catch (OAuth2AuthorizationCodeRequestAuthenticationException e) {\n    if (\"invalid_request\".equals(e.getError().getErrorCode())) {\n        logger.warn(\"Authorization request rejected for client: {}\", e.getError().getDescription());\n    }\n}","preventionTips":["Register all clients before issuing authorization requests","Keep the RegisteredClientRepository store consistent across environments","Build authorize URLs programmatically from the registered client's clientId"],"tags":["oauth2","authorization-code","invalid-request","client"],"backgroundTag":"record-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}