{"record":{"id":"ba7311876110fe7a","repo":"apereo/cas","slug":"ignoring-malformed-request-as-no-oauth20-vali","errorCode":null,"errorMessage":"Ignoring malformed request [{}] as no OAuth20 validator could declare support for its syntax","messagePattern":"Ignoring malformed request \\[(.+?)\\] as no OAuth20 validator could declare support for its syntax","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/endpoints/OAuth20RevocationEndpointController.java","lineNumber":135,"sourceCode":"            }\n            val mv = new ModelAndView(new JacksonJsonView());\n            mv.setStatus(HttpStatus.OK);\n            return mv;\n        }\n        LOGGER.error(\"Provided token [{}] is either not a refresh token or an access token\", token);\n        return OAuth20Utils.writeError(response, OAuth20Constants.INVALID_REQUEST);\n\n    }\n\n    private boolean verifyRevocationRequest(final WebContext context) throws Throwable {\n        val validator = getConfigurationContext().getAccessTokenGrantRequestValidators().getObject()\n            .stream()\n            .filter(BeanSupplier::isNotProxy)\n            .filter(Unchecked.predicate(requestValidator -> requestValidator.supports(context)))\n            .findFirst()\n            .orElse(null);\n        if (validator == null) {\n            LOGGER.warn(\"Ignoring malformed request [{}] as no OAuth20 validator could declare support for its syntax\", context.getFullRequestURL());\n            return false;\n        }\n        return validator.validate(context);\n    }\n}\n","sourceCodeStart":117,"sourceCodeEnd":141,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/endpoints/OAuth20RevocationEndpointController.java#L117-L141","documentation":"The revocation endpoint iterates its configured OAuth20RequestValidators and requires exactly one to declare support for the request's syntax (per RFC 7009 the request must carry a token parameter with client authentication). If no validator supports the request context, the request is malformed and is rejected (verifyRevocationRequest returns false), so revocation is not attempted.","triggerScenarios":"A POST to /oauth2.0/revoke that is missing the required `token` parameter, or otherwise doesn't match any registered validator's supports(context) check (e.g. wrong HTTP method, missing client authentication parameters).","commonSituations":"Client library sends GET instead of POST, or sends the token under a nonstandard parameter name; reverse proxy strips the body/form params; misconfigured custom validator bean that never declares support; calling the endpoint without client_id/client_secret.","solutions":["Send a POST with form-encoded `token` parameter plus valid client authentication (client_id/client_secret or Basic auth).","Verify the request body is application/x-www-form-urlencoded and not stripped by a proxy or gateway.","Check registered OAuth20RequestValidator beans — if a custom validator was added/removed, ensure at least the standard validator remains and supports the request.","Log the full request URL (as the warning does) and compare it against the validator's supports() conditions."],"exampleFix":"// before\ncurl https://cas/cas/oauth2.0/revoke?token=AT-123  # GET, query param, no auth\n// after\ncurl -X POST -u client:secret -d 'token=AT-123' -H 'Content-Type: application/x-www-form-urlencoded' https://cas/cas/oauth2.0/revoke","handlingStrategy":"validation","validationCode":"// ensure required revocation params before sending\nconst params = new URLSearchParams({ token, client_id, client_secret });\nif (!token || !client_id) throw new Error('revocation requires token and client credentials');\nawait fetch(revokeUrl, { method: 'POST', headers: {'Content-Type':'application/x-www-form-urlencoded'}, body: params });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always POST form-encoded to the revocation endpoint with client authentication.","Confirm no proxy rewrites or drops the request body.","After CAS upgrades, re-check configured OAuth20RequestValidator beans."],"tags":["oauth2","revocation","malformed-request","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}