{"record":{"id":"b3435636063678b7","repo":"spring-projects/spring-security","slug":"authorization-request-not-found","errorCode":"authorization_request_not_found","errorMessage":"authorization_request_not_found","messagePattern":"authorization_request_not_found","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2LoginAuthenticationFilter.java","lineNumber":178,"sourceCode":"\t\tAssert.notNull(clientRegistrationRepository, \"clientRegistrationRepository cannot be null\");\n\t\tAssert.notNull(authorizedClientRepository, \"authorizedClientRepository cannot be null\");\n\t\tthis.clientRegistrationRepository = clientRegistrationRepository;\n\t\tthis.authorizedClientRepository = authorizedClientRepository;\n\t}\n\n\t@Override\n\tpublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)\n\t\t\tthrows AuthenticationException {\n\t\tMultiValueMap<String, String> params = OAuth2AuthorizationResponseUtils.toMultiMap(request.getParameterMap());\n\t\tif (!OAuth2AuthorizationResponseUtils.isAuthorizationResponse(params)) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\t\tOAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestRepository\n\t\t\t.removeAuthorizationRequest(request, response);\n\t\tif (authorizationRequest == null) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(AUTHORIZATION_REQUEST_NOT_FOUND_ERROR_CODE);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\t\tString registrationId = authorizationRequest.getAttribute(OAuth2ParameterNames.REGISTRATION_ID);\n\t\tAssert.hasText(registrationId, \"registrationId cannot be empty\");\n\t\tClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId(registrationId);\n\t\tif (clientRegistration == null) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(CLIENT_REGISTRATION_NOT_FOUND_ERROR_CODE,\n\t\t\t\t\t\"Client Registration not found with Id: \" + registrationId, null);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\t\t// @formatter:off\n\t\tString redirectUri = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))\n\t\t\t\t.replaceQuery(null)\n\t\t\t\t.build()\n\t\t\t\t.toUriString();\n\t\t// @formatter:on\n\t\tOAuth2AuthorizationResponse authorizationResponse = OAuth2AuthorizationResponseUtils.convert(params,\n\t\t\t\tredirectUri);\n\t\tObject authenticationDetails = this.authenticationDetailsSource.buildDetails(request);","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2LoginAuthenticationFilter.java#L160-L196","documentation":"During the OAuth2 callback the filter removes the stored OAuth2AuthorizationRequest (typically from the session via HttpSessionOAuth2AuthorizationRequestRepository). If no stored request exists, the callback is unsolicited and this error with code authorization_request_not_found is thrown.","triggerScenarios":"The redirect_uri is hit with code/state parameters but the session that started login is gone: cookie lost, session expired, server restarted without sticky sessions, or the callback arrives in a different browser/session.","commonSituations":"Multiple backend nodes without sticky sessions or shared session store; SameSite/cookie policies dropping JSESSIONID on cross-site redirect; users clicking an old callback link from history; cookies blocked by the browser.","solutions":["Use sticky sessions or a shared session store (e.g. Spring Session with Redis/JDBC) across all nodes","Verify the JSESSIONID cookie survives the redirect to the IdP (check SameSite=None; Secure when IdP is cross-site)","Have users restart the login flow from /oauth2/authorization/{registrationId}; clear stale cookies","If callbacks are intentionally unsolicited, configure the authorizationRequestRepository appropriately or relax the filter per Spring Security docs on unsolicited responses"],"exampleFix":"// before\n// multiple nodes, in-memory sessions, round-robin LB\n// after\n// enable Spring Session\n<dependency>\n  <groupId>org.springframework.session</groupId>\n  <artifactId>spring-session-data-redis</artifactId>\n</dependency>","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"catch (OAuth2AuthenticationException e) {\n    if (\"authorization_request_not_found\".equals(e.getError().getErrorCode())) {\n        // redirect user to /oauth2/authorization/{id} to restart login\n    }\n}","preventionTips":["Use sticky sessions or Spring Session (Redis/JDBC) across nodes","Check cookie flags (SameSite/Secure) so JSESSIONID survives the IdP redirect","Invalidate stale bookmarks of redirect URIs and restart login from the app"],"tags":["oauth2","spring-security","session","callback"],"backgroundTag":"invalid-state-transition","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}