{"record":{"id":"d102813d95f2d041","repo":"apereo/cas","slug":"invalid-request-d10281","errorCode":"invalid_request","errorMessage":"CAS cannot accept the request given the issuer is invalid.","messagePattern":"CAS cannot accept the request given the issuer is invalid\\.","errorType":"console","errorClass":null,"httpStatus":400,"severity":"error","filePath":"support/cas-server-support-oidc-vc/src/main/java/org/apereo/cas/oidc/vc/issuer/web/OidcVerifiableCredentialIssuerMetadataController.java","lineNumber":56,"sourceCode":"\n    /**\n     * Handle response entity.\n     *\n     * @param request  the request\n     * @param response the response\n     * @return the response entity\n     */\n    @GetMapping(value = {\n        '/' + OidcConstants.BASE_OIDC_URL + '/' + OidcConstants.WELL_KNOWN_OPENID_CREDENTIAL_ISSUER_URL,\n        \"/**/\" + OidcConstants.WELL_KNOWN_OPENID_CREDENTIAL_ISSUER_URL\n    }, produces = MediaType.APPLICATION_JSON_VALUE)\n    @Operation(summary = \"Handle OIDC credential issuer metadata request\",\n        description = \"Handles requests for well-known OIDC credential issuer metadata\")\n    public ResponseEntity handle(final HttpServletRequest request,\n                                 final HttpServletResponse response) {\n        val webContext = new JEEContext(request, response);\n        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.WELL_KNOWN_OPENID_CREDENTIAL_ISSUER_URL))) {\n            LOGGER.warn(\"CAS cannot accept the request given the issuer is invalid.\");\n            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, \"Invalid issuer\");\n            return ResponseEntity.badRequest().body(body);\n        }\n        val body = metadataService.build();\n        return ResponseEntity.ok().body(body);\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":64,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-vc/src/main/java/org/apereo/cas/oidc/vc/issuer/web/OidcVerifiableCredentialIssuerMetadataController.java#L38-L64","documentation":"OidcVerifiableCredentialIssuerMetadataController.handle serves the well-known OpenID credential issuer metadata document only when the request's issuer matches the configured OIDC issuer. On mismatch it returns HTTP 400 with error 'invalid_request' and 'Invalid issuer'.","triggerScenarios":"GET /oidc/.well-known/openid-credential-issuer (WELL_KNOWN_OPENID_CREDENTIAL_ISSUER_URL) with a Host/URL that does not match cas.authn.oidc.issuer per issuerService.validateIssuer.","commonSituations":"Wallet/client discovering metadata via a different hostname or port than the configured issuer; reverse proxy not forwarding the original host; environment (dev vs prod) issuer mismatch.","solutions":["Discover metadata using the issuer identifier URL exactly as configured in CAS.","Fix proxy configuration to preserve the Host header (or set forwarded-header handling in CAS).","Align cas.authn.oidc.issuer with the externally visible base URL."],"exampleFix":"// before\ncurl http://internal-host:8080/cas/oidc/.well-known/openid-credential-issuer\n// after\ncurl https://sso.example.org/cas/oidc/.well-known/openid-credential-issuer","handlingStrategy":"validation","validationCode":"// Discover via issuer identifier\nURI wellKnown = URI.create(issuer + \"/.well-known/openid-credential-issuer\");\nif (!wellKnown.getHost().equals(URI.create(issuer).getHost())) {\n    throw new IllegalArgumentException(\"Issuer host mismatch\");\n}","typeGuard":null,"tryCatchPattern":"if (resp.status() == 400 && body.contains(\"Invalid issuer\")) {\n    throw new IllegalStateException(\"Metadata discovery must use the configured issuer URL\");\n}","preventionTips":["Fetch metadata from the exact issuer value in the client configuration","Avoid switching hostnames (localhost vs FQDN) between environments","Enable forwarded header support on CAS behind TLS-terminating proxies"],"tags":["oidc","verifiable-credentials","issuer","metadata"],"backgroundTag":"invalid-url","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}