{"record":{"id":"cdc207e355b71db1","repo":"apereo/cas","slug":"response-type-not-authorized-for-service-not","errorCode":null,"errorMessage":"Response type not authorized for service: [{}] not listed in supported response types: [{}]","messagePattern":"Response type not authorized for service: \\[(.+?)\\] not listed in supported response types: \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/DefaultOAuth20RequestParameterResolver.java","lineNumber":207,"sourceCode":"\n    @Override\n    public boolean isAuthorizedGrantTypeForService(final WebContext context,\n                                                   final OAuthRegisteredService registeredService) {\n        val grantType = resolveRequestParameter(context, OAuth20Constants.GRANT_TYPE)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        return OAuth20RequestParameterResolver.isAuthorizedGrantTypeForService(grantType, registeredService);\n    }\n\n    @Override\n    public boolean isAuthorizedResponseTypeForService(final WebContext context,\n                                                      final OAuthRegisteredService registeredService) {\n        if (registeredService.getSupportedResponseTypes() != null && !registeredService.getSupportedResponseTypes().isEmpty()) {\n            val responseType = resolveRequestParameter(context, OAuth20Constants.RESPONSE_TYPE)\n                .map(String::valueOf).orElse(StringUtils.EMPTY);\n            if (registeredService.getSupportedResponseTypes().stream().anyMatch(s -> s.equalsIgnoreCase(responseType))) {\n                return true;\n            }\n            LOGGER.warn(\"Response type not authorized for service: [{}] not listed in supported response types: [{}]\",\n                responseType, registeredService.getSupportedResponseTypes());\n            return false;\n        }\n        LOGGER.warn(\"Registered service [{}] does not define any authorized/supported response types. \"\n            + \"It is STRONGLY recommended that you authorize and assign response types to the service definition. \"\n            + \"While just a warning for now, this behavior will be enforced by CAS in future versions.\", registeredService.getName());\n        return true;\n    }\n\n    @Override\n    public Pair<String, String> resolveClientIdAndClientSecret(final CallContext callContext) {\n        val extractor = new BasicAuthExtractor();\n        val upcResult = extractor.extract(callContext);\n        if (upcResult.isPresent()) {\n            val upc = (UsernamePasswordCredentials) upcResult.get();\n            return Pair.of(upc.getUsername(), upc.getPassword());\n        }\n        val clientId = resolveRequestParameter(callContext.webContext(), OAuth20Constants.CLIENT_ID)","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/DefaultOAuth20RequestParameterResolver.java#L189-L225","documentation":"DefaultOAuth20RequestParameterResolver.isAuthorizedResponseTypeForService() compares the request's response_type against the registered service's supportedResponseTypes. When the list is non-empty but does not contain the requested response type, it warns and returns false, so the OAuth request (e.g., authorize) is denied as the requested response type is not authorized for that service.","triggerScenarios":"An authorize/device request with response_type=code (or token/id_token variants) for a service whose supportedResponseTypes excludes that value, or the parameter is missing (resolves to empty string) while the list is non-empty.","commonSituations":"Service JSON defines supportedResponseTypes [\"token\"] but client requests code; response_type parameter omitted entirely by the client; service entry copied from another app with a narrower type list; CAS version upgrade enforcing response-type matching.","solutions":["Add the response_type the client requests (e.g., \"code\") to the service's supportedResponseTypes.","Ensure the client sends the response_type parameter on authorize requests.","Reload the services registry after editing the definition.","Audit each client app's expected flow (code vs implicit) and align service definitions accordingly."],"exampleFix":"// before (service JSON)\n\"supportedResponseTypes\": [\"token\"]\n// after\n\"supportedResponseTypes\": [\"code\", \"token\"]","handlingStrategy":"validation","validationCode":"const responseType = params.response_type;\nif (!responseType || !service.supportedResponseTypes?.some(t => t.toLowerCase() === responseType.toLowerCase())) {\n  throw new Error(`response_type '${responseType}' not authorized for this service`);\n}","typeGuard":"function isResponseTypeAuthorized(service, responseType) {\n  return typeof responseType === 'string' &&\n    Array.isArray(service.supportedResponseTypes) &&\n    service.supportedResponseTypes.some(t => t.toLowerCase() === responseType.toLowerCase());\n}","tryCatchPattern":null,"preventionTips":["Always send response_type on authorize requests","Align supportedResponseTypes with each client's flow (code vs token/id_token)","Case-insensitively match but prefer exact registered values"],"tags":["oauth","response-type","authorization-code","service-definition"],"backgroundTag":"unsupported-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}