{"record":{"id":"b6a76a8e9c044cb2","repo":"apereo/cas","slug":"response-type-or-grant-type-is-not-suppo","errorCode":null,"errorMessage":"Response type [{}] or grant type [{}] is not supported.","messagePattern":"Response type \\[(.+?)\\] or grant type \\[(.+?)\\] is not supported\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20DeviceCodeResponseTypeRequestValidator.java","lineNumber":52,"sourceCode":"    private final ServicesManager servicesManager;\n\n    private final ServiceFactory<WebApplicationService> webApplicationServiceServiceFactory;\n\n    private final OAuth20RequestParameterResolver requestParameterResolver;\n\n    private int order = Ordered.LOWEST_PRECEDENCE;\n\n    @Override\n    public boolean validate(final WebContext context) {\n        val responseType = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.RESPONSE_TYPE)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val grantType = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.GRANT_TYPE)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val validResponseType = OAuth20Utils.isResponseType(responseType, OAuth20ResponseTypes.DEVICE_CODE);\n        val validGrantType = OAuth20Utils.isGrantType(grantType, OAuth20GrantTypes.DEVICE_CODE);\n\n        if (!validResponseType && !validGrantType) {\n            LOGGER.warn(\"Response type [{}] or grant type [{}] is not supported.\", responseType, grantType);\n            return false;\n        }\n\n        val clientId = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.CLIENT_ID).orElse(StringUtils.EMPTY);\n        return FunctionUtils.doAndHandle(() -> {\n            val registeredService = Objects.requireNonNull(OAuth20Utils.getRegisteredOAuthServiceByClientId(this.servicesManager, clientId));\n            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);\n            return (validResponseType && requestParameterResolver.isAuthorizedResponseTypeForService(context, registeredService))\n                   || (validGrantType && requestParameterResolver.isAuthorizedGrantTypeForService(context, registeredService));\n        }, t -> {\n            LOGGER.warn(\"Registered service access is not allowed for service definition for client id [{}]\", clientId);\n            return false;\n        }).get();\n    }\n\n    @Override\n    public boolean supports(final WebContext context) {\n        val responseType = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.RESPONSE_TYPE)","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20DeviceCodeResponseTypeRequestValidator.java#L34-L70","documentation":"The device-code validator accepts a request only if it presents either response_type=device_code or grant_type=urn:ietf:params:oauth:grant-type:device_code. If neither parameter indicates the device-code flow, the validator logs this message and declines to handle the request, letting other token/authorization validators take over or fail. It signals the request was routed to the device endpoint with the wrong parameters.","triggerScenarios":"POST /oauth2.0/token or the device endpoint with response_type=code / grant_type=authorization_code instead of device_code values; missing or empty grant_type parameter entirely.","commonSituations":"Developer points a standard authorization-code or password client at the device-token endpoint; client library omits grant_type on device access-token polls; migration from another IdP that used different device grant URIs.","solutions":["Send response_type=device_code (device authorization start) or grant_type=urn:ietf:params:oauth:grant-type:device_code (token poll) as appropriate for the endpoint.","Ensure the device client actually requests a device code from the device-authorization endpoint before polling the token endpoint.","Enable the CAS device-code flow feature/config so the validator and its registered-service checks are active for your client.","Check that grant_type is not being stripped or mangled by intermediate proxies or client HTTP form encoding."],"exampleFix":"// before\nPOST /oauth2.0/token grant_type=authorization_code&code=ABC\n// after (device token poll)\nPOST /oauth2.0/token grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=DEV123&client_id=app","handlingStrategy":"validation","validationCode":"const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';\nif (!['device_code'].includes(responseType) && grantType !== DEVICE_GRANT) {\n  throw new Error('request must be a device_code response/grant');\n}","typeGuard":"const isDeviceCodeRequest = (p) => p.responseType === 'device_code' || p.grantType === 'urn:ietf:params:oauth:grant-type:device_code';","tryCatchPattern":null,"preventionTips":["Use a dedicated device-flow client module that sets the correct grant_type on every poll.","Do not reuse standard OAuth client configs for the device endpoint.","Confirm the CAS device-code feature is enabled before pointing clients at the endpoint."],"tags":["oauth","device-code","grant-type","response-type"],"backgroundTag":"unsupported-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}