{"record":{"id":"bd577602f47157ff","repo":"spring-projects/spring-security","slug":"malformed-response-data","errorCode":"malformed_response_data","errorMessage":"malformedResponseData(ex.getMessage())","messagePattern":"malformedResponseData\\(ex\\.getMessage\\(\\)\\)","errorType":"error_code","errorClass":"Saml2AuthenticationException","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/BaseOpenSamlAuthenticationProvider.java","lineNumber":324,"sourceCode":"\t\tcatch (Saml2AuthenticationException ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2AuthenticationException(Saml2Error.internalValidationError(ex.getMessage()), ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<?> authentication) {\n\t\treturn Saml2AuthenticationToken.class.isAssignableFrom(authentication);\n\t}\n\n\tprivate Response parseResponse(String response) throws Saml2Exception, Saml2AuthenticationException {\n\t\ttry {\n\t\t\treturn this.saml.deserialize(response);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2AuthenticationException(Saml2Error.malformedResponseData(ex.getMessage()), ex);\n\t\t}\n\t}\n\n\tprivate void process(Saml2AuthenticationToken token, Response response) {\n\t\tString issuer = issuer(response);\n\t\tthis.logger.debug(LogMessage.format(\"Processing SAML response from %s\", issuer));\n\t\tboolean responseSigned = response.isSigned();\n\n\t\tResponseToken responseToken = new ResponseToken(response, token);\n\t\tCollection<Saml2Error> responseSignatureErrors = this.responseSignatureValidator.convert(responseToken)\n\t\t\t.getErrors();\n\t\tif (!responseSignatureErrors.isEmpty()) {\n\t\t\treportErrors(response, responseSignatureErrors);\n\t\t\treturn;\n\t\t}\n\n\t\tCollection<Saml2Error> errors = new ArrayList<>();\n\t\tif (responseSigned) {","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/BaseOpenSamlAuthenticationProvider.java#L306-L342","documentation":"parseResponse throws malformed_response_data when the SAML response XML cannot be deserialized by OpenSAML (this.saml.deserialize). This means the received payload is not parseable SAML XML — it is malformed, truncated, HTML (e.g. an error page), or base64-decoded incorrectly.","triggerScenarios":"The POSTed SAMLResponse parameter decodes to invalid XML; the IdP returned an HTML error/login page instead of a SAML response; the base64 payload was double-encoded or mangled by the client/proxy; response body truncated.","commonSituations":"Misconfigured ACS URL causing the IdP to return an error page; proxy servers modifying the POST body; clients sending deflated or non-base64 encodings; single-logout or relay flows where the wrong payload is posted to the assertion consumer endpoint.","solutions":["Base64-decode the received SAMLResponse and inspect it — confirm it is well-formed XML with a saml2p:Response root","Verify the ACS URL and binding configuration on both SP and IdP so the IdP posts a real SAML response","Check for proxies/load balancers altering the POST body (compression, chunking, charset issues)","Log the raw response (careful: it may contain PII) to confirm what the IdP actually sends"],"exampleFix":"// before\nString decoded = new String(Base64.getDecoder().decode(samlResponse)); // may throw on bad input, sent to SP anyway\n// after\nbyte[] bytes = Base64.getMimeDecoder().decode(samlResponse.trim());\nif (!new String(bytes, StandardCharsets.UTF_8).contains(\"<saml2p:Response\")) {\n    throw new IllegalArgumentException(\"Not a SAML response\");\n}","handlingStrategy":"validation","validationCode":"byte[] decoded = Base64.getMimeDecoder().decode(samlResponse.trim());\nString xml = new String(decoded, StandardCharsets.UTF_8);\nif (!xml.contains(\"<saml2p:Response\") && !xml.contains(\"<Response\")) {\n    throw new IllegalArgumentException(\"Payload is not a SAML response XML\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Authentication result = provider.authenticate(token);\n} catch (Saml2AuthenticationException e) {\n    if (Saml2ErrorCodes.MALFORMED_RESPONSE_DATA.equals(e.getError().getErrorCode())) {\n        logger.warn(\"Unparseable SAMLResponse received; check IdP/ACS configuration\", e);\n        response.sendError(400);\n    }\n}","preventionTips":["Verify the ACS URL so the IdP never posts HTML error pages to it","Base64-decode and eyeball a sample SAMLResponse during integration testing","Check proxies/load balancers do not transform POST bodies","Use MIME-decoder Base64 which tolerates line breaks in IdP payloads"],"tags":["saml2","spring-security","xml-parsing"],"backgroundTag":"malformed-saml-response","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}