{"record":{"id":"db045f4d7c1cee9d","repo":"spring-projects/spring-security","slug":"an-error-occurred-reading-the-oauth-2-0-authorizat","errorCode":null,"errorMessage":"An error occurred reading the OAuth 2.0 Authorization Server Metadata: + ex.getMessage()","messagePattern":"An error occurred reading the OAuth 2\\.0 Authorization Server Metadata: \\+ ex\\.getMessage\\(\\)","errorType":"http","errorClass":"HttpMessageNotReadableException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/http/converter/OAuth2AuthorizationServerMetadataHttpMessageConverter.java","lineNumber":84,"sourceCode":"\t\tthis.jsonMessageConverter = converter;\n\t}\n\n\t@Override\n\tprotected boolean supports(Class<?> clazz) {\n\t\treturn OAuth2AuthorizationServerMetadata.class.isAssignableFrom(clazz);\n\t}\n\n\t@Override\n\t@SuppressWarnings(\"unchecked\")\n\tprotected OAuth2AuthorizationServerMetadata readInternal(Class<? extends OAuth2AuthorizationServerMetadata> clazz,\n\t\t\tHttpInputMessage inputMessage) throws HttpMessageNotReadableException {\n\t\ttry {\n\t\t\tMap<String, Object> authorizationServerMetadataParameters = (Map<String, Object>) this.jsonMessageConverter\n\t\t\t\t.read(STRING_OBJECT_MAP.getType(), null, inputMessage);\n\t\t\treturn this.authorizationServerMetadataConverter.convert(authorizationServerMetadataParameters);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new HttpMessageNotReadableException(\n\t\t\t\t\t\"An error occurred reading the OAuth 2.0 Authorization Server Metadata: \" + ex.getMessage(), ex,\n\t\t\t\t\tinputMessage);\n\t\t}\n\t}\n\n\t@Override\n\tprotected void writeInternal(OAuth2AuthorizationServerMetadata authorizationServerMetadata,\n\t\t\tHttpOutputMessage outputMessage) throws HttpMessageNotWritableException {\n\t\ttry {\n\t\t\tMap<String, Object> authorizationServerMetadataResponseParameters = this.authorizationServerMetadataParametersConverter\n\t\t\t\t.convert(authorizationServerMetadata);\n\t\t\tthis.jsonMessageConverter.write(authorizationServerMetadataResponseParameters, STRING_OBJECT_MAP.getType(),\n\t\t\t\t\tMediaType.APPLICATION_JSON, outputMessage);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new HttpMessageNotWritableException(\n\t\t\t\t\t\"An error occurred writing the OAuth 2.0 Authorization Server Metadata: \" + ex.getMessage(), ex);\n\t\t}","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/http/converter/OAuth2AuthorizationServerMetadataHttpMessageConverter.java#L66-L102","documentation":"OAuth2AuthorizationServerMetadataHttpMessageConverter reads authorization-server metadata from an HTTP response body by delegating to an inner JSON converter, then converts the parameter map into an OAuth2AuthorizationServerMetadata. Any exception in either step is wrapped in an HttpMessageNotReadableException whose message embeds the underlying exception message, indicating the metadata document could not be read or validated.","triggerScenarios":"Fetching the authorization server metadata (/.well-known/oauth-authorization-server or openid-configuration) when the response body is not a JSON object, contains invalid JSON, or is missing/has invalid required metadata parameters.","commonSituations":"Misconfigured issuer URL returning an HTML error page instead of JSON; proxy/firewall intercepting the request; server emitting metadata with wrong types (e.g. string where boolean expected) that fails the metadata converter; wrong content-type from the server.","solutions":["Verify the metadata endpoint URL is correct and returns valid JSON with the right content-type (application/json)","Inspect the wrapped cause (ex.getCause()/getMessage) to see the exact conversion failure and fix the served metadata accordingly","Check for proxies/gateways altering the response (HTML login/error pages) and exclude the metadata path","If you serve the metadata, ensure all required fields (issuer, token_endpoint, etc.) are present with correct types"],"exampleFix":"// before: wrong endpoint\nString uri = \"https://auth.example.com/.well-known/openid-configuration/mistyped\";\n// after: correct well-known URI for OAuth2 AS metadata\nString uri = issuer + \"/.well-known/oauth-authorization-server\";\nOAuth2AuthorizationServerMetadata metadata = rest.getForObject(uri, OAuth2AuthorizationServerMetadata.class);","handlingStrategy":"try-catch","validationCode":"// fetch and sanity-check the metadata JSON before converting\nconst resp = await fetch(metadataUrl);\nconst contentType = resp.headers.get('content-type') || '';\nif (!contentType.includes('application/json')) {\n  throw new Error(`Expected JSON metadata, got ${contentType}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  metadata = converter.read(OAuth2AuthorizationServerMetadata.class, inputMessage);\n} catch (HttpMessageNotReadableException e) {\n  throw new IllegalStateException(\n    \"Authorization server metadata unreadable: \" + e.getMessage() +\n    \" — verify the well-known URI returns valid JSON\", e);\n}","preventionTips":["Verify the well-known metadata URL with curl before wiring it into clients","Ensure no proxy/gateway replaces the JSON body with an HTML page","Check content-type headers on the authorization server's metadata endpoint","Validate served metadata against the spec (issuer, response_types, token_endpoint present)"],"tags":["oauth2","metadata","http","json"],"backgroundTag":"invalid-json-response","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}