{"record":{"id":"e1f97257475c44a6","repo":"spring-projects/spring-security","slug":"server-error-e1f972","errorCode":"server_error","errorMessage":"Failed to compute hash for Session ID.","messagePattern":"Failed to compute hash for Session ID\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":500,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcLogoutAuthenticationProvider.java","lineNumber":168,"sourceCode":"\t\t\tAssert.notNull(authorizedUserPrincipal, \"authorizedUserPrincipal cannot be null\");\n\t\t\tif (!StringUtils.hasText(idToken.getSubject())\n\t\t\t\t\t|| !currentUserPrincipal.getName().equals(authorizedUserPrincipal.getName())) {\n\t\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_TOKEN, IdTokenClaimNames.SUB);\n\t\t\t}\n\n\t\t\t// Check for active session\n\t\t\tif (StringUtils.hasText(oidcLogoutAuthentication.getSessionId())) {\n\t\t\t\tSessionInformation sessionInformation = findSessionInformation(currentUserPrincipal,\n\t\t\t\t\t\toidcLogoutAuthentication.getSessionId());\n\t\t\t\tif (sessionInformation != null) {\n\t\t\t\t\tString sessionIdHash;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tsessionIdHash = createHash(sessionInformation.getSessionId());\n\t\t\t\t\t}\n\t\t\t\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\t\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\t\t\t\"Failed to compute hash for Session ID.\", null);\n\t\t\t\t\t\tthrow new OAuth2AuthenticationException(error);\n\t\t\t\t\t}\n\n\t\t\t\t\tString sidClaim = idToken.getClaim(\"sid\");\n\t\t\t\t\tif (!StringUtils.hasText(sidClaim) || !sidClaim.equals(sessionIdHash)) {\n\t\t\t\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_TOKEN, \"sid\");\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Authenticated logout request\");\n\t\t}\n\n\t\treturn new OidcLogoutAuthenticationToken(idToken, (Authentication) oidcLogoutAuthentication.getPrincipal(),\n\t\t\t\toidcLogoutAuthentication.getSessionId(), oidcLogoutAuthentication.getClientId(),\n\t\t\t\toidcLogoutAuthentication.getPostLogoutRedirectUri(), oidcLogoutAuthentication.getState());\n\t}","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcLogoutAuthenticationProvider.java#L150-L186","documentation":"Thrown by OidcLogoutAuthenticationProvider.authenticate when hashing the session ID for the required sid (session-id) claim comparison fails because no hashing algorithm is available on the platform (NoSuchAlgorithmException). The provider treats this as a server_error because it cannot complete RP-initiated logout validation.","triggerScenarios":"During an OIDC RP-initiated logout request with an id_token_hint, the provider hashes the current session's ID (createHash, default SHA-256 via MessageDigest) and receives NoSuchAlgorithmException — practically only when the JRE lacks the configured digest algorithm (e.g. hardened/fips JCE policy or non-standard hash algorithm configured).","commonSituations":"FIPS-restricted JVMs or stripped-down JREs where 'SHA-256' MessageDigest is unavailable; custom OidcLogoutAuthenticationProvider configuration overriding the session-id hash algorithm to a name not registered in the JCE provider list.","solutions":["Verify the JVM exposes the digest algorithm: run MessageDigest.getInstance(\"SHA-256\") in the same environment and check available Security.getProviders()","If a custom hash algorithm was configured for the sid claim, switch to a standard one (SHA-256) available in all JREs","On FIPS JVMs, register/enable a JCE provider (e.g. BouncyCastle FIPS) that supplies the required MessageDigest","Catch the resulting OAuth2AuthenticationException server_error at the filter/filter-chain level and return a 500 with logs for ops diagnosis"],"exampleFix":"// before (custom algorithm not present in JVM)\noidcLogoutAuthenticationProvider.setSessionIdHashAlgorithm(\"SHA3-256\");\n// after\noidcLogoutAuthenticationProvider.setSessionIdHashAlgorithm(\"SHA-256\");","handlingStrategy":"try-catch","validationCode":"try {\n    javax.crypto.Mac.getInstance(\"HmacSHA256\");\n    java.security.MessageDigest.getInstance(\"SHA-256\");\n} catch (java.security.NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\"JVM lacks required digest algorithms\", e);\n} // run at startup to fail fast","typeGuard":null,"tryCatchPattern":"try {\n    oidcLogoutFilter.doFilter(request, response, chain);\n} catch (OAuth2AuthenticationException e) {\n    if (OAuth2ErrorCodes.SERVER_ERROR.equals(e.getError().getErrorCode())) {\n        // environment problem: missing MessageDigest, alert ops\n        response.sendError(500, \"Logout processing failed\");\n        return;\n    }\n    response.sendError(401);\n}","preventionTips":["Verify MessageDigest availability of the configured hash algorithm at application startup","On FIPS/hardened JVMs, register a JCE provider supplying SHA-256","Stick to standard algorithms (SHA-256) for the sid claim","Monitor logs for NoSuchAlgorithmException from the logout path"],"tags":["oidc","logout","session","hashing","spring-authorization-server"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}