{"record":{"id":"a8831b5b432a2eff","repo":"apereo/cas","slug":"invalid-request-a8831b","errorCode":"invalid_request","errorMessage":"CAS cannot accept the request given the issuer is invalid.","messagePattern":"CAS cannot accept the request given the issuer is invalid\\.","errorType":"console","errorClass":null,"httpStatus":400,"severity":"error","filePath":"support/cas-server-support-oidc-vc/src/main/java/org/apereo/cas/oidc/vc/issuer/web/OidcVerifiableCredentialTypeMetadataController.java","lineNumber":60,"sourceCode":"    /**\n     * Handle response entity.\n     *\n     * @param request  the request\n     * @param response the response\n     * @return the response entity\n     */\n    @GetMapping(value = {\n        '/' + OidcConstants.BASE_OIDC_URL + '/' + OidcConstants.VC_CREDENTIAL_TYPE_URL + \"/{configurationId}\",\n        \"/**/\" + OidcConstants.VC_CREDENTIAL_TYPE_URL + \"/{configurationId}\"},\n        produces = MediaType.APPLICATION_JSON_VALUE)\n    @Operation(summary = \"Handle OIDC credential configuration type request\",\n        description = \"Handles requests for OIDC credential configuration type metadata\",\n        parameters = @Parameter(name = \"configurationId\", in = ParameterIn.PATH, description = \"Configuration ID\"))\n    public ResponseEntity handle(final HttpServletRequest request, final HttpServletResponse response,\n                                 @PathVariable final String configurationId) {\n        val webContext = new JEEContext(request, response);\n        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.VC_CREDENTIAL_TYPE_URL))) {\n            LOGGER.warn(\"CAS cannot accept the request given the issuer is invalid.\");\n            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, \"Invalid issuer\");\n            return ResponseEntity.badRequest().body(body);\n        }\n        val body = metadataService.describeConfiguration(configurationId);\n        return body == null\n            ? ResponseEntity.notFound().build()\n            : ResponseEntity.ok().body(body);\n    }\n\n}\n","sourceCodeStart":42,"sourceCodeEnd":71,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-vc/src/main/java/org/apereo/cas/oidc/vc/issuer/web/OidcVerifiableCredentialTypeMetadataController.java#L42-L71","documentation":"OidcVerifiableCredentialTypeMetadataController.handle describes a credential configuration (by configurationId) for verifiable credentials. Before describing, it validates the request issuer against VC_CREDENTIAL_TYPE_URL; on failure it returns HTTP 400 'invalid_request' / 'Invalid issuer'.","triggerScenarios":"GET the credential type metadata endpoint with a valid path configurationId but from a request whose issuer/host does not match the configured OIDC issuer.","commonSituations":"Clients caching discovery metadata from one environment and reusing host URLs from another; DNS aliases (internal vs external names); missing Host header preservation behind ingress.","solutions":["Use the externally configured issuer host/path when requesting type metadata.","Correct ingress/proxy Host and X-Forwarded-Proto headers.","Ensure the configured issuer matches the URL scheme (https) and hostname presented by clients."],"exampleFix":"// before\ncurl https://10.0.0.5/cas/oidc/vc/credential-types/UniversityDegree_JWT\n// after\ncurl https://sso.example.org/cas/oidc/vc/credential-types/UniversityDegree_JWT","handlingStrategy":"validation","validationCode":"// Derive type metadata URL from issuer, not from cached/internal hosts\nString typeUrl = issuer + \"/vc/credential-types/\" + configurationId;\nif (!typeUrl.startsWith(issuer)) throw new IllegalArgumentException(\"URL not under issuer\");","typeGuard":null,"tryCatchPattern":"if (resp.status() == 400 && body.contains(\"Invalid issuer\")) {\n    throw new IllegalStateException(\"Re-fetch issuer metadata and use its URLs\");\n}","preventionTips":["Refresh cached discovery documents after environment changes","Avoid IP-address or internal-name access to OIDC endpoints","Align issuer configuration with ingress host rules"],"tags":["oidc","verifiable-credentials","issuer","metadata"],"backgroundTag":"invalid-url","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}