{"record":{"id":"e30c357215e9591d","repo":"spring-projects/spring-security","slug":"invalid-client-registration-fieldname-e30c35","errorCode":null,"errorMessage":"Invalid Client Registration: + fieldName","messagePattern":"Invalid Client Registration: \\+ fieldName","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationValidator.java","lineNumber":300,"sourceCode":"\t\t\t\tLOGGER.debug(LogMessage.format(\n\t\t\t\t\t\t\"Invalid request: scope must not be set during Dynamic Client Registration ('%s')\", scopes));\n\t\t\t}\n\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_SCOPE, OidcClientMetadataClaimNames.SCOPE);\n\t\t}\n\t}\n\n\tprivate static void validateScopeSimple(OidcClientRegistrationAuthenticationContext authenticationContext) {\n\t\t// No validation. Preserves prior behavior.\n\t}\n\n\tprivate static boolean isUnsafeScheme(String scheme) {\n\t\treturn \"javascript\".equalsIgnoreCase(scheme) || \"data\".equalsIgnoreCase(scheme)\n\t\t\t\t|| \"vbscript\".equalsIgnoreCase(scheme);\n\t}\n\n\tprivate static OAuth2AuthenticationException createException(String errorCode, String fieldName) {\n\t\tOAuth2Error error = new OAuth2Error(errorCode, \"Invalid Client Registration: \" + fieldName, ERROR_URI);\n\t\tthrow new OAuth2AuthenticationException(error);\n\t}\n\n}\n","sourceCodeStart":282,"sourceCodeEnd":304,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationValidator.java#L282-L304","documentation":"Validation failure raised by OidcClientRegistrationAuthenticationValidator when a specific registration metadata field fails one of its strict validators. createException wraps the error code and field name (redirect_uris or scope) into an OAuth2AuthenticationException.","triggerScenarios":"register a client where redirect_uris are not strictly valid (validateRedirectUrisStrict: non-absolute or non-http(s) URIs), contain a fragment (validateRedirectUrisFragmentOnly), jwks_uri is invalid (validateJwkSetUri), or scope contains invalid characters/entries (validateScope).","commonSituations":"Developers registering clients with localhost/plain-relative URIs, redirect URIs containing '#fragment', a jwks_uri that is not a valid https URL, or scopes with whitespace/illegal characters; also seen when front-ends URL-encode or truncate redirect URIs.","solutions":["Use fully-qualified absolute http/https URIs with no fragment for every redirect_uri","Remove any '#fragment' component from redirect URIs — fragments are forbidden by spec","Ensure jwks_uri is a well-formed absolute URL pointing to the client's JWK Set","Validate the scope string: space-separated tokens using allowed characters (no commas, no empty entries)"],"exampleFix":"// before\n\"redirect_uris\": [\"https://app.example.com/cb#section\"]\n// after\n\"redirect_uris\": [\"https://app.example.com/cb\"]","handlingStrategy":"validation","validationCode":"static boolean isValidRedirectUri(String uri) {\n    try {\n        URI u = new URI(uri);\n        return (\"http\".equals(u.getScheme()) || \"https\".equals(u.getScheme()))\n            && u.isAbsolute() && u.getRawFragment() == null;\n    } catch (URISyntaxException e) { return false; }\n}\nredirectUris.stream().allMatch(YourClass::isValidRedirectUri);","typeGuard":"boolean isValidRedirectUri(URI u) {\n    return u != null && u.isAbsolute()\n        && (u.getScheme().equals(\"http\") || u.getScheme().equals(\"https\"))\n        && u.getFragment() == null;\n}","tryCatchPattern":null,"preventionTips":["Always use absolute http(s) redirect URIs with no fragments","Keep a shared client-side validator mirroring the server's strict rules","Test registrations in CI against a local authorization server instance","Watch for URL-encoding layers (gateways, templates) that mutate redirect URIs"],"tags":["oauth2","oidc","client-registration","redirect-uri","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}