{"record":{"id":"d4bc080659b5ffab","repo":"spring-projects/spring-security","slug":"oauth-2-0-parameter-parametername-d4bc08","errorCode":null,"errorMessage":"OAuth 2.0 Parameter: ${parameterName}","messagePattern":"OAuth 2\\.0 Parameter: (.+?)","errorType":"error_code","errorClass":"OAuth2AuthorizationCodeRequestAuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java","lineNumber":240,"sourceCode":"\t\t\t.toString()\n\t\t\t.toLowerCase(Locale.ROOT)\n\t\t\t.endsWith(authorizationServerSettings.getPushedAuthorizationRequestEndpoint().toLowerCase(Locale.ROOT));\n\t}\n\n\tprivate static RequestMatcher createDefaultRequestMatcher() {\n\t\tfinal RequestMatcher authorizationConsentMatcher = OAuth2AuthorizationConsentAuthenticationConverter\n\t\t\t.createDefaultRequestMatcher();\n\t\treturn (request) -> \"GET\".equals(request.getMethod())\n\t\t\t\t|| (\"POST\".equals(request.getMethod()) && !authorizationConsentMatcher.matches(request));\n\t}\n\n\tprivate static void throwError(String errorCode, String parameterName) {\n\t\tthrowError(errorCode, parameterName, DEFAULT_ERROR_URI);\n\t}\n\n\tprivate static void throwError(String errorCode, String parameterName, String errorUri) {\n\t\tOAuth2Error error = new OAuth2Error(errorCode, \"OAuth 2.0 Parameter: \" + parameterName, errorUri);\n\t\tthrow new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);\n\t}\n\n}\n","sourceCodeStart":222,"sourceCodeEnd":244,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java#L222-L244","documentation":"OAuth2AuthorizationCodeRequestAuthenticationConverter throws OAuth2AuthorizationCodeRequestAuthenticationException with the description \"OAuth 2.0 Parameter: <parameterName>\" when the authorization endpoint request (/oauth2/authorize) is missing or has an invalid required parameter (e.g. response_type, client_id, redirect_uri, scope, state, code_challenge). The library rejects malformed authorization requests early in the converter so they never reach the authorization service. The description names the offending parameter so the client can fix the request.","triggerScenarios":"convert() calls throwError() when: the request URI is not the configured authorization endpoint; required parameters like client_id or response_type are absent; response_type is not \"code\"; redirect_uri is malformed or missing; scope contains invalid characters; or PKCE code_challenge/code_challenge_method values are invalid on an authorization code request.","commonSituations":"A client app builds the /oauth2/authorize URL by hand and forgets response_type=code; a misconfigured redirect_uri (not registered or not an absolute URL); missing state parameter when the client requires it; typos in scope strings; an upgraded Spring Authorization Server version enforcing stricter parameter validation than the client sends.","solutions":["Inspect the exception's OAuth2Error description to identify the exact parameter named after \"OAuth 2.0 Parameter:\" and ensure it is sent correctly.","Fix the authorization request URL to include all required params: response_type=code, client_id, redirect_uri (registered), and scope if required.","If PKCE is enforced, send a valid code_challenge (S256) and code_challenge_method with the authorization request.","If you must customize handling, register a custom AuthenticationConverter or FailureHandler on the authorization server filter instead of bypassing validation."],"exampleFix":"// before: hand-built authorize URL missing params\nString url = \"/oauth2/authorize?client_id=my-client\";\n// after\nString url = \"/oauth2/authorize?response_type=code\"\n    + \"&client_id=my-client\"\n    + \"&redirect_uri=https://app.example.com/callback\"\n    + \"&scope=openid\"\n    + \"&state=\" + state\n    + \"&code_challenge=\" + s256Challenge + \"&code_challenge_method=S256\";","handlingStrategy":"validation","validationCode":"function validateAuthorizeRequest(params) {\n  const errors = [];\n  if (!params.get('response_type')) errors.push('response_type is required');\n  else if (params.get('response_type') !== 'code') errors.push('response_type must be \"code\"');\n  if (!params.get('client_id')) errors.push('client_id is required');\n  if (!params.get('redirect_uri')) errors.push('redirect_uri is required');\n  else { try { new URL(params.get('redirect_uri')); } catch { errors.push('redirect_uri must be an absolute URL'); } }\n  return errors;\n}\nconst errs = validateAuthorizeRequest(new URLSearchParams(authorizeUrl));\nif (errs.length) throw new Error('Invalid authorize request: ' + errs.join('; '));","typeGuard":"function hasRequiredAuthorizeParams(p) {\n  return typeof p === 'object' && p !== null\n    && typeof p.client_id === 'string' && p.client_id.length > 0\n    && p.response_type === 'code'\n    && typeof p.redirect_uri === 'string' && p.redirect_uri.startsWith('https://');\n}","tryCatchPattern":"try {\n  authorizationResponse = performAuthorizationRequest(request);\n} catch (OAuth2AuthorizationCodeRequestAuthenticationException e) {\n  OAuth2Error err = e.getError();\n  logger.warn(\"Authorization request rejected: code={} description={}\", err.getErrorCode(), err.getDescription());\n  // redirect user back to client with error=invalid_request&error_description=...\n}","preventionTips":["Use a maintained OAuth2 client library to build the authorize URL instead of string concatenation.","Keep redirect_uri values identical to those registered on the server (scheme, host, port, path).","Always send response_type=code, client_id, redirect_uri, scope, and state in every authorization request.","Generate a proper S256 code_challenge when PKCE is enforced."],"tags":["oauth2","authorization-server","request-validation","spring-security"],"backgroundTag":"invalid-query-parameter","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}