{"record":{"id":"b9f506342d7116e7","repo":"karatelabs/karate","slug":"missing-authorizationurl-in-oauth-config","errorCode":null,"errorMessage":"Missing 'authorizationUrl' in OAuth config","messagePattern":"Missing 'authorizationUrl' in OAuth config","errorType":"validation","errorClass":"OAuth2Exception","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/http/AuthorizationCodeAuthHandler.java","lineNumber":134,"sourceCode":"            return token;\n\n        } catch (Exception e) {\n            logger.error(\"Authorization flow failed: {}\", e.getMessage());\n            throw new OAuth2Exception(\"Authorization flow failed: \" + e.getMessage(), e);\n        } finally {\n            if (callbackServer != null) {\n                callbackServer.stop();\n            }\n        }\n    }\n\n    /**\n     * Build authorization URL with all required parameters\n     */\n    private String buildAuthorizationUrl(PkceGenerator pkce, String redirectUri) {\n        String authzEndpoint = (String) config.get(\"authorizationUrl\");\n        if (authzEndpoint == null) {\n            throw new OAuth2Exception(\"Missing 'authorizationUrl' in OAuth config\");\n        }\n\n        String clientId = (String) config.get(\"client_id\");\n        if (clientId == null) {\n            throw new OAuth2Exception(\"Missing 'client_id' in OAuth config\");\n        }\n\n        String scope = (String) config.getOrDefault(\"scope\", \"\");\n\n        StringBuilder url = new StringBuilder(authzEndpoint);\n        url.append(authzEndpoint.contains(\"?\") ? \"&\" : \"?\");\n        url.append(\"response_type=code\");\n        url.append(\"&client_id=\").append(urlEncode(clientId));\n        url.append(\"&redirect_uri=\").append(urlEncode(redirectUri));\n        url.append(\"&code_challenge=\").append(urlEncode(pkce.getChallenge()));\n        url.append(\"&code_challenge_method=\").append(pkce.getMethod());\n\n        if (!scope.isEmpty()) {","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/http/AuthorizationCodeAuthHandler.java#L116-L152","documentation":"buildAuthorizationUrl() requires an 'authorizationUrl' entry in the OAuth config map to construct the provider's authorize endpoint URL. If the key is absent, an OAuth2Exception is thrown immediately — the flow cannot start because there is nowhere to redirect the user for consent.","triggerScenarios":"Calling authUrl() (via buildAuthorizationUrl) on a config map that lacks the 'authorizationUrl' key — e.g. a partially populated config, a typo like 'authorizationURL' or 'authUrl', or reusing a client-credentials config that only has a token endpoint.","commonSituations":"Config copied from a different OAuth flow that does not need an authorize endpoint, YAML/JSON key casing mistakes, or forgetting to set the key when assembling config programmatically.","solutions":["Add 'authorizationUrl' (the provider's /authorize endpoint) to the OAuth config map","Check key spelling and casing exactly matches 'authorizationUrl'","Validate all required keys (authorizationUrl, client_id, url) before invoking the flow"],"exampleFix":"// before\nconfig = { \"client_id\": \"abc\", \"url\": \"https://idp/token\" }\n// after\nconfig = { \"client_id\": \"abc\", \"url\": \"https://idp/token\", \"authorizationUrl\": \"https://idp/authorize\" }","handlingStrategy":"validation","validationCode":"// fail fast before calling authUrl()\nObject authz = config.get(\"authorizationUrl\");\nif (authz == null || authz.toString().isBlank()) {\n    throw new IllegalArgumentException(\"config.authorizationUrl is required\");\n}","typeGuard":"static String requireConfigKey(Map<String, Object> config, String key) {\n    Object v = config.get(key);\n    if (!(v instanceof String s) || s.isBlank()) {\n        throw new IllegalArgumentException(\"Missing '\" + key + \"' in OAuth config\");\n    }\n    return s;\n}","tryCatchPattern":"try {\n    String url = handler.authUrl(pkce, redirectUri);\n} catch (OAuth2Exception e) {\n    if (e.getMessage().contains(\"authorizationUrl\")) {\n        throw new ConfigurationException(\"Add authorizationUrl to OAuth config\", e);\n    }\n    throw e;\n}","preventionTips":["Validate the complete OAuth config at startup, not lazily","Use a typed config class with required fields instead of a raw Map","Check exact snake_case key names against the handler's expectations","Keep sample/template config files in the repo for each provider"],"tags":["oauth2","configuration","missing-config","authentication"],"backgroundTag":"missing-required-config-field","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}