{"record":{"id":"d7173cb7fc0c380b","repo":"spring-projects/spring-security","slug":"server-error-d7173c","errorCode":"server_error","errorMessage":"Unable to process the access token response.","messagePattern":"Unable to process the access token response\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":500,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AccessTokenResponseAuthenticationSuccessHandler.java","lineNumber":76,"sourceCode":"\n\tprivate final Log logger = LogFactory.getLog(getClass());\n\n\tprivate final HttpMessageConverter<OAuth2AccessTokenResponse> accessTokenResponseConverter = new OAuth2AccessTokenResponseHttpMessageConverter();\n\n\tprivate @Nullable Consumer<OAuth2AccessTokenAuthenticationContext> accessTokenResponseCustomizer;\n\n\t@Override\n\tpublic void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,\n\t\t\tAuthentication authentication) throws IOException, ServletException {\n\t\tif (!(authentication instanceof OAuth2AccessTokenAuthenticationToken accessTokenAuthentication)) {\n\t\t\tif (this.logger.isErrorEnabled()) {\n\t\t\t\tthis.logger.error(Authentication.class.getSimpleName() + \" must be of type \"\n\t\t\t\t\t\t+ OAuth2AccessTokenAuthenticationToken.class.getName() + \" but was \"\n\t\t\t\t\t\t+ authentication.getClass().getName());\n\t\t\t}\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"Unable to process the access token response.\", null);\n\t\t\tthrow new OAuth2AuthenticationException(error);\n\t\t}\n\n\t\tOAuth2AccessToken accessToken = accessTokenAuthentication.getAccessToken();\n\t\tOAuth2RefreshToken refreshToken = accessTokenAuthentication.getRefreshToken();\n\t\tMap<String, Object> additionalParameters = accessTokenAuthentication.getAdditionalParameters();\n\n\t\tOAuth2AccessTokenResponse.Builder builder = OAuth2AccessTokenResponse.withToken(accessToken.getTokenValue())\n\t\t\t.tokenType(accessToken.getTokenType())\n\t\t\t.scopes(accessToken.getScopes());\n\t\tif (accessToken.getIssuedAt() != null && accessToken.getExpiresAt() != null) {\n\t\t\tbuilder.expiresIn(ChronoUnit.SECONDS.between(accessToken.getIssuedAt(), accessToken.getExpiresAt()));\n\t\t}\n\t\tif (refreshToken != null) {\n\t\t\tbuilder.refreshToken(refreshToken.getTokenValue());\n\t\t}\n\t\tif (!CollectionUtils.isEmpty(additionalParameters)) {\n\t\t\tbuilder.additionalParameters(additionalParameters);\n\t\t}","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AccessTokenResponseAuthenticationSuccessHandler.java#L58-L94","documentation":"Thrown by OAuth2AccessTokenResponseAuthenticationSuccessHandler.onAuthenticationSuccess() when the Authentication argument is not an OAuth2AccessTokenAuthenticationToken. This handler only knows how to write an access-token response, so receiving any other authentication type (e.g. an authorization-code or client-authentication token) is a programming/configuration error surfaced as OAuth2AuthenticationException with code server_error.","triggerScenarios":"Registering this success handler on a filter/endpoint that can produce non-token-success outcomes, e.g. wiring it into OAuth2ClientAuthenticationFilter or an authorization endpoint where the authenticated result is not an issued access token.","commonSituations":"Custom SecurityFilterChain wiring where the handler is attached to the wrong filter; upgrade of spring-authorization-server changing which filter emits OAuth2AccessTokenAuthenticationToken; tests calling onAuthenticationSuccess directly with a stub authentication.","solutions":["Attach the handler only to the token endpoint (OAuth2TokenEndpointFilter) where authentication results are OAuth2AccessTokenAuthenticationToken.","Inspect the handler registration in the SecurityFilterChain and move it to the correct filter's success handler.","In tests, pass an OAuth2AccessTokenAuthenticationToken (with access token, etc.) instead of a mock Authentication.","If handling multiple outcomes, add a custom handler that type-checks instanceof OAuth2AccessTokenAuthenticationToken and delegates otherwise."],"exampleFix":"// before\nOAuth2ClientAuthenticationFilter clientFilter = ...;\nclientFilter.setAuthenticationSuccessHandler(new OAuth2AccessTokenResponseAuthenticationSuccessHandler()); // wrong filter\n// after\nOAuth2TokenEndpointFilter tokenEndpoint = ...;\ntokenEndpoint.setAuthenticationSuccessHandler(new OAuth2AccessTokenResponseAuthenticationSuccessHandler());","handlingStrategy":"type-guard","validationCode":"boolean isTokenSuccess(Authentication a) {\n    return a instanceof OAuth2AccessTokenAuthenticationToken;\n}","typeGuard":"if (authentication instanceof OAuth2AccessTokenAuthenticationToken tokenAuth) {\n    successHandler.onAuthenticationSuccess(request, response, tokenAuth);\n} else {\n    log.warn(\"Skipping token response handler: wrong authentication type \" + authentication.getClass());\n}","tryCatchPattern":"try {\n    successHandler.onAuthenticationSuccess(request, response, authentication);\n} catch (OAuth2AuthenticationException e) {\n    if (\"server_error\".equals(e.getError().getErrorCode())) {\n        log.error(\"Handler attached to a filter that does not produce OAuth2AccessTokenAuthenticationToken\");\n    }\n    throw e;\n}","preventionTips":["Only register OAuth2AccessTokenResponseAuthenticationSuccessHandler on the token endpoint filter.","Add an integration test asserting the filter chain emits OAuth2AccessTokenAuthenticationToken to the handler.","Review wiring after spring-authorization-server upgrades for filter name/API changes."],"tags":["oauth2","spring-security","handler-misconfiguration","type-mismatch"],"backgroundTag":"type-mismatch","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}