{"record":{"id":"a852bf56d8e14501","repo":"spring-projects/spring-security","slug":"removed-expired-pushed-authorization-request-for-c","errorCode":null,"errorMessage":"Removed expired pushed authorization request for client id '%s'","messagePattern":"Removed expired pushed authorization request for client id '(.+?)'","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java","lineNumber":167,"sourceCode":"\t\t\tif (this.logger.isTraceEnabled()) {\n\t\t\t\tthis.logger.trace(\"Retrieved authorization with pushed authorization request\");\n\t\t\t}\n\n\t\t\tOAuth2AuthorizationRequest authorizationRequest = pushedAuthorization\n\t\t\t\t.getAttribute(OAuth2AuthorizationRequest.class.getName());\n\t\t\tAssert.notNull(authorizationRequest, \"authorizationRequest cannot be null\");\n\n\t\t\tif (!authorizationCodeRequestAuthentication.getClientId().equals(authorizationRequest.getClientId())) {\n\t\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.CLIENT_ID,\n\t\t\t\t\t\tauthorizationCodeRequestAuthentication, null);\n\t\t\t}\n\n\t\t\tif (Instant.now().isAfter(pushedAuthorizationRequestUri.getExpiresAt())) {\n\t\t\t\t// Remove (effectively invalidating) the pushed authorization request\n\t\t\t\tthis.authorizationService.remove(pushedAuthorization);\n\t\t\t\tif (this.logger.isWarnEnabled()) {\n\t\t\t\t\tthis.logger\n\t\t\t\t\t\t.warn(LogMessage.format(\"Removed expired pushed authorization request for client id '%s'\",\n\t\t\t\t\t\t\t\tauthorizationRequest.getClientId()));\n\t\t\t\t}\n\t\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,\n\t\t\t\t\t\tauthorizationCodeRequestAuthentication, null);\n\t\t\t}\n\n\t\t\tauthorizationCodeRequestAuthentication = new OAuth2AuthorizationCodeRequestAuthenticationToken(\n\t\t\t\t\tauthorizationCodeRequestAuthentication.getAuthorizationUri(), authorizationRequest.getClientId(),\n\t\t\t\t\t(Authentication) authorizationCodeRequestAuthentication.getPrincipal(),\n\t\t\t\t\tauthorizationRequest.getRedirectUri(), authorizationRequest.getState(),\n\t\t\t\t\tauthorizationRequest.getScopes(), authorizationRequest.getAdditionalParameters());\n\t\t}\n\n\t\tRegisteredClient registeredClient = this.registeredClientRepository\n\t\t\t.findByClientId(authorizationCodeRequestAuthentication.getClientId());\n\t\tif (registeredClient == null) {\n\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.CLIENT_ID,\n\t\t\t\t\tauthorizationCodeRequestAuthentication, null);","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java#L149-L185","documentation":"This warning is emitted by OAuth2AuthorizationCodeRequestAuthenticationProvider when a pushed authorization request (PAR, RFC 9126) referenced via request_uri is retrieved from the authorization service but its expiresAt timestamp has passed. The provider removes the stored pushed authorization request, effectively invalidating it, and throws an OAuth2AuthenticationException with error INVALID_REQUEST and the request_uri parameter reported as invalid.","triggerScenarios":"A client is redirected to the authorization endpoint with a request_uri obtained from a PAR POST, but more than the configured pushedAuthorizationRequestTimeToLive has elapsed before the authorization endpoint is hit. The lookup finds the expired authorization and takes this branch.","commonSituations":"Users sitting on a pre-built authorize URL beyond the PAR TTL (often 30-90s default), slow redirects through an external IdP chain, or stale bookmarked/deep-linked authorize URLs reused across sessions.","solutions":["Push the authorization request again (POST to the par endpoint) immediately before redirecting the user to the authorization endpoint, so the request_uri is fresh.","Increase OAuth2AuthorizationServerConfigurer's pushedAuthorizationRequestTimeToLive if legitimate flows need longer.","Fix client flow orchestration so the authorize redirect happens right after obtaining the request_uri (no intermediate user detours).","Handle the invalid_request error on request_uri by transparently re-pushing the request and retrying the redirect."],"exampleFix":"// before: request_uri created long before redirect\nString requestUri = pushRequest();\nscheduleRedirectAfterUserReview(requestUri); // may exceed TTL\n// after: push right before redirect\nString requestUri = pushRequest();\nresponse.sendRedirect(authorizeUrl(requestUri));","handlingStrategy":"retry","validationCode":"// validate request_uri freshness before redirecting\nInstant pushedAt = getPushedRequestTime(requestUri);\nif (pushedAt.plus(parTtl).isBefore(Instant.now())) {\n  requestUri = pushAuthorizationRequest(); // re-push before it is rejected\n}","typeGuard":null,"tryCatchPattern":"try {\n  redirectToAuthorize(requestUri);\n} catch (OAuth2AuthenticationException e) {\n  if (\"invalid_request\".equals(e.getError().getErrorCode())) {\n    // re-push the PAR and retry with a fresh request_uri\n    requestUri = pushAuthorizationRequest();\n    redirectToAuthorize(requestUri);\n  }\n}","preventionTips":["Push the PAR immediately before the authorize redirect","Set pushedAuthorizationRequestTimeToLive to cover your real-world flow latency","Do not persist or re-bookmark authorize URLs containing request_uri","Handle invalid_request on request_uri by transparently re-pushing"],"tags":["oauth2","par","pushed-authorization-request","expired","invalid-request"],"backgroundTag":"jwt-token-expired","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}