{"record":{"id":"a781945a753914ea","repo":"thephpleague/oauth2-server","slug":"invalid-request-response-type","errorCode":null,"errorMessage":"invalid request: response_type","messagePattern":"invalid request: response_type","errorType":"http","errorClass":"OAuthServerException","httpStatus":400,"severity":"error","filePath":"src/AuthorizationServer.php","lineNumber":117,"sourceCode":"        $grantType->setDefaultScope($this->defaultScope);\n        $grantType->setPrivateKey($this->privateKey);\n        $grantType->setEmitter($this->getEmitter());\n        $grantType->setEncryptionKey($this->encryptionKey);\n        $grantType->revokeRefreshTokens($this->revokeRefreshTokens);\n\n        $this->enabledGrantTypes[$grantType->getIdentifier()] = $grantType;\n        $this->grantTypeAccessTokenTTL[$grantType->getIdentifier()] = $accessTokenTTL;\n    }\n\n    /**\n     * Validate an authorization request\n     *\n     * @throws OAuthServerException\n     */\n    public function validateAuthorizationRequest(ServerRequestInterface $request): AuthorizationRequestInterface\n    {\n        if (!isset($request->getQueryParams()['response_type'])) {\n            throw OAuthServerException::invalidRequest('response_type');\n        }\n\n        foreach ($this->enabledGrantTypes as $grantType) {\n            if ($grantType->canRespondToAuthorizationRequest($request)) {\n                return $grantType->validateAuthorizationRequest($request);\n            }\n        }\n\n        throw OAuthServerException::unsupportedGrantType();\n    }\n\n    /**\n     * Complete an authorization request\n     */\n    public function completeAuthorizationRequest(\n        AuthorizationRequestInterface $authRequest,\n        ResponseInterface $response\n    ): ResponseInterface {","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/AuthorizationServer.php#L99-L135","documentation":"Thrown by validateAuthorizationRequest when the authorization query string contains no 'response_type' parameter. The authorization server cannot decide between the authorization-code and implicit flows without it, so it raises an invalid_request OAuth error before any grant is matched.","triggerScenarios":"Calling AuthorizationServer::validateAuthorizationRequest() with a PSR-7 GET request whose query params lack 'response_type' (e.g. GET /authorize?client_id=...&redirect_uri=... only).","commonSituations":"Frontend builds the authorize URL manually and forgets response_type; a redirect template drops the query parameter; user edits the URL; proxies stripping query strings.","solutions":["Add response_type=code (authorization code flow) or response_type=token (implicit flow) to the authorization request query string.","Verify the request reaching validateAuthorizationRequest actually preserves query params (check proxy/rewrite rules).","Ensure the client app uses the library's redirect/build logic that appends all required params."],"exampleFix":"// before\n$authUrl = 'https://auth.example.com/authorize?client_id=abc&redirect_uri=https://app/cb';\n// after\n$authUrl = 'https://auth.example.com/authorize?client_id=abc&redirect_uri=https://app/cb&response_type=code&state=s3t4t3';","handlingStrategy":"validation","validationCode":"$params = $request->getQueryParams();\nif (!isset($params['response_type']) || $params['response_type'] === '') {\n    throw new \\InvalidArgumentException('response_type query parameter is required');\n}","typeGuard":null,"tryCatchPattern":"try { $req = $server->validateAuthorizationRequest($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response()); }","preventionTips":["Always build authorize URLs from a single helper that appends response_type, client_id, redirect_uri and state","Test the authorize endpoint with a query-param contract test"],"tags":["oauth","authorization-request","missing-parameter"],"backgroundTag":"missing-required-argument","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}