{"record":{"id":"b934618c8bbbe050","repo":"spring-projects/spring-security","slug":"server-error-b93461","errorCode":"SERVER_ERROR","errorMessage":"The token generator failed to generate the authorization code.","messagePattern":"The token generator failed to generate the authorization code\\.","errorType":"error_code","errorClass":"OAuth2AuthorizationCodeRequestAuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java","lineNumber":311,"sourceCode":"\t\t\tSet<String> currentAuthorizedScopes = (currentAuthorizationConsent != null)\n\t\t\t\t\t? currentAuthorizationConsent.getScopes() : null;\n\n\t\t\tMap<String, Object> additionalParameters = new HashMap<>();\n\t\t\tif (pushedAuthorization != null) {\n\t\t\t\tadditionalParameters.put(OAuth2ParameterNames.SCOPE, authorizationRequest.getScopes());\n\t\t\t}\n\n\t\t\treturn new OAuth2AuthorizationConsentAuthenticationToken(authorizationRequest.getAuthorizationUri(),\n\t\t\t\t\tregisteredClient.getClientId(), principal, state, currentAuthorizedScopes, additionalParameters);\n\t\t}\n\n\t\tOAuth2TokenContext tokenContext = createAuthorizationCodeTokenContext(authorizationCodeRequestAuthentication,\n\t\t\t\tregisteredClient, null, authorizationRequest.getScopes());\n\t\tOAuth2AuthorizationCode authorizationCode = this.authorizationCodeGenerator.generate(tokenContext);\n\t\tif (authorizationCode == null) {\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"The token generator failed to generate the authorization code.\", ERROR_URI);\n\t\t\tthrow new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);\n\t\t}\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Generated authorization code\");\n\t\t}\n\n\t\tOAuth2Authorization authorization = authorizationBuilder(registeredClient, principal, authorizationRequest)\n\t\t\t.authorizedScopes(authorizationRequest.getScopes())\n\t\t\t.token(authorizationCode)\n\t\t\t.build();\n\t\tthis.authorizationService.save(authorization);\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Saved authorization\");\n\t\t}\n\n\t\tif (pushedAuthorization != null) {\n\t\t\t// Enforce one-time use by removing the pushed authorization request","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java#L293-L329","documentation":"In OAuth2AuthorizationCodeRequestAuthenticationProvider.authenticate (the authorization endpoint), the configured OAuth2AuthorizationCodeGenerator (or generator chain) is invoked to create the authorization code. If it returns null — no generator supports the context — the provider throws OAuth2AuthorizationCodeRequestAuthenticationException with this SERVER_ERROR message.","triggerScenarios":"A client hits the /oauth2/authorization endpoint to start the authorization code flow, but the OAuth2AuthorizationCodeGenerator bean is missing, misconfigured, or a custom generator returns null for the authorization-code token context.","commonSituations":"Overriding the authorizationCodeGenerator bean with a partial implementation; the default generator's SecureRandom/UUID source unavailable; builder wiring mistake when customizing authorization server settings.","solutions":["Ensure the default OAuth2AuthorizationCodeGenerator is registered (or include it in your composite via OAuth2ConfigurerUtils.getAuthorizationCodeGenerator).","Fix custom OAuth2AuthorizationCodeGenerator.generate() so it returns a non-null OAuth2AuthorizationCode for valid contexts.","Check generator delegation: return null only when another generator downstream will handle the context.","Re-enable default authorization server config if the generator bean was accidentally removed."],"exampleFix":"// before\n@Bean\nOAuth2TokenGenerator<?> authorizationCodeGenerator() {\n    return context -> null; // always fails\n}\n\n// after\n@Bean\nOAuth2TokenGenerator<?> authorizationCodeGenerator() {\n    return new OAuth2AuthorizationCodeGenerator();\n}","handlingStrategy":"try-catch","validationCode":"OAuth2AuthorizationCode code = authorizationCodeGenerator.generate(codeContext);\nif (code == null) {\n    throw new IllegalStateException(\"Authorization code generator returned null; check bean wiring\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // GET /oauth2/authorization?...\n} catch (OAuth2AuthorizationCodeRequestAuthenticationException ex) {\n    if (OAuth2ErrorCodes.SERVER_ERROR.equals(ex.getError().getErrorCode())) {\n        log.error(\"Authorization code generator misconfigured: {}\", ex.getError().getDescription());\n    }\n    throw ex;\n}","preventionTips":["Do not override the OAuth2AuthorizationCodeGenerator bean without delegating to the default","Add a smoke test hitting the authorization endpoint on startup","When compositing generators, ensure the code generator is registered before generic fallbacks"],"tags":["oauth2","authorization-code","token-generation"],"backgroundTag":"missing-configuration","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}