{"record":{"id":"9dff7c92b2b8558f","repo":"spring-projects/spring-security","slug":"invalid-request-9dff7c","errorCode":"invalid_request","errorMessage":"invalid_request","messagePattern":"invalid_request","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilter.java","lineNumber":243,"sourceCode":"\t}\n\n\tprivate static void validateClientIdentifier(Authentication authentication) {\n\t\tif (!(authentication instanceof OAuth2ClientAuthenticationToken)) {\n\t\t\treturn;\n\t\t}\n\n\t\t// As per spec, in Appendix A.1.\n\t\t// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#appendix-A.1\n\t\t// The syntax for client_id is *VSCHAR (%x20-7E):\n\t\t// -> Hex 20 -> ASCII 32 -> space\n\t\t// -> Hex 7E -> ASCII 126 -> tilde\n\n\t\tOAuth2ClientAuthenticationToken clientAuthentication = (OAuth2ClientAuthenticationToken) authentication;\n\t\tString clientId = (String) clientAuthentication.getPrincipal();\n\t\tfor (int i = 0; i < clientId.length(); i++) {\n\t\t\tchar charAt = clientId.charAt(i);\n\t\t\tif (!(charAt >= 32 && charAt <= 126)) {\n\t\t\t\tthrow new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);\n\t\t\t}\n\t\t}\n\t}\n\n}\n","sourceCodeStart":225,"sourceCodeEnd":249,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilter.java#L225-L249","documentation":"This OAuth2AuthenticationException with code invalid_request is thrown by OAuth2ClientAuthenticationFilter.validateClientIdentifier when the authenticated client_id contains characters outside the printable ASCII range (32-126). The filter rejects non-printable or non-ASCII characters in client identifiers to prevent parsing/injection issues in token endpoint authentication.","triggerScenarios":"A token endpoint request whose client_id (after client authentication resolution) contains control characters, unicode, or other chars below 32 or above 126.","commonSituations":"Client sending a client_id copied with hidden unicode characters (zero-width spaces, BOM); misconfigured identity provider injecting non-ASCII identifiers; URL-encoded values decoded into non-ASCII characters.","solutions":["Inspect and sanitize the client_id sent by the client to contain only printable ASCII","Remove hidden/invisible characters (BOM, zero-width spaces) from configuration","Re-register the client with a plain ASCII identifier if the stored clientId is non-ASCII","Log the offending client_id characters to find where the non-ASCII value originates"],"exampleFix":"// before: client_id with hidden characters\nString clientId = \"my\\u200Bclient\";\n// after: sanitize before sending\nString clientId = requestClientId.replaceAll(\"[^\\\\x20-\\\\x7E]\", \"\");","handlingStrategy":"validation","validationCode":"// Validate client_id is printable ASCII before sending it\nif (!clientId.chars().allMatch(c -> c >= 32 && c <= 126)) {\n    throw new IllegalArgumentException(\"client_id must be printable ASCII\");\n}","typeGuard":"boolean isPrintableAscii(String s) {\n    return s != null && s.chars().allMatch(c -> c >= 32 && c <= 126);\n}","tryCatchPattern":"try {\n    // token endpoint call\n} catch (OAuth2AuthenticationException e) {\n    if (\"invalid_request\".equals(e.getError().getErrorCode())) {\n        logger.error(\"client_id rejected; check for non-ASCII/control characters\");\n    }\n}","preventionTips":["Sanitize client identifiers when copying from docs or config (strip BOM/zero-width chars)","Store only ASCII client_ids in your client registry","Normalize and validate configuration values at client startup"],"tags":["oauth2","client-authentication","invalid-request","input-validation"],"backgroundTag":"invalid-identifier-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}