{"record":{"id":"eec49de9071f6e13","repo":"quarkusio/quarkus","slug":"authorization-response-iss-parameter-is-required","errorCode":null,"errorMessage":"Authorization response 'iss' parameter is required but is not present","messagePattern":"Authorization response 'iss' parameter is required but is not present","errorType":"http","errorClass":"AuthenticationCompletionException","httpStatus":401,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java","lineNumber":931,"sourceCode":"    }\n\n    private void validateAuthorizationResponseIssuer(MultiMap requestParams, TenantConfigContext configContext) {\n        String expectedIssuer = configContext.getOidcMetadata().getIssuer();\n\n        if (expectedIssuer == null || OidcProvider.ANY_ISSUER.equals(expectedIssuer)) {\n            return;\n        }\n\n        String issParam = requestParams.get(OidcConstants.CODE_FLOW_ISSUER);\n\n        if (issParam != null) {\n            if (!issParam.equals(expectedIssuer)) {\n                throw new AuthenticationCompletionException(String.format(\n                        \"Authorization response 'iss' parameter '%s' does not match the expected issuer '%s'\",\n                        issParam, expectedIssuer));\n            }\n        } else if (configContext.getOidcMetadata().isAuthorizationResponseIssParameterSupported()) {\n            throw new AuthenticationCompletionException(\n                    \"Authorization response 'iss' parameter is required but is not present\");\n        }\n    }\n\n    private Uni<SecurityIdentity> performCodeFlow(IdentityProviderManager identityProviderManager,\n            RoutingContext context, TenantConfigContext configContext, MultiMap requestParams,\n            String[] parsedStateCookieValue) {\n\n        String userPath = null;\n        String userQuery = null;\n\n        // This is an original redirect from IDP, check if the original request path and query need to be restored\n        CodeAuthenticationStateBean stateBean = getCodeAuthenticationBean(parsedStateCookieValue, configContext);\n\n        try {\n            validateAuthorizationResponseIssuer(requestParams, configContext);\n        } catch (AuthenticationCompletionException ex) {\n            LOG.error(ex.getMessage());","sourceCodeStart":913,"sourceCodeEnd":949,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java#L913-L949","documentation":"If the OIDC provider's discovery metadata advertises authorization_response_iss_parameter_supported=true, the provider is required to include the 'iss' parameter in the authorization response. When the callback to the redirect_uri lacks the 'iss' parameter even though the metadata says it is supported, Quarkus treats the response as incomplete/possibly tampered and throws AuthenticationCompletionException.","triggerScenarios":"configContext.getOidcMetadata().isAuthorizationResponseIssParameterSupported() is true but requestParams.get(CODE_FLOW_ISSUER) is null in the code flow callback handling.","commonSituations":"A reverse proxy or gateway strips unknown query parameters (like iss) from the redirect back to the app; provider metadata over-declares iss support while its actual responses omit it; older provider version behind a newer discovery document.","solutions":["Check proxy/gateway/filter configuration so that all query parameters, including 'iss', survive the redirect back to the redirect_uri.","Verify the actual authorization response URL (enable quarkus.oidc logs) and confirm whether iss is present.","If the provider does not actually send iss, fix/upgrade the provider or disable iss enforcement in metadata handling.","Ensure the redirect_uri matches exactly what is registered so the callback carries the full original query string."],"exampleFix":"// before (nginx rewrite dropping params)\nproxy_pass http://app/callback?code=$arg_code;\n// after\nproxy_pass http://app/$request_uri;","handlingStrategy":"validation","validationCode":"// Check that the callback URL retained all query parameters\nif (metadata.isAuthorizationResponseIssParameterSupported()\n        && !callbackUri.getQuery().contains(\"iss=\")) {\n    log.warn(\"Provider advertises iss support but callback lacks 'iss'; check proxies/redirect handling\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return completeAuthentication(callbackParams);\n} catch (AuthenticationCompletionException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"'iss' parameter is required but is not present\")) {\n        log.error(\"'iss' stripped from authorization response; inspect proxy/gateway rewrite rules\");\n    }\n    throw e;\n}","preventionTips":["Do not strip or rewrite query parameters on the callback route in proxies/CDNs.","Test the full code flow behind any reverse proxy before production.","Pin/verify provider metadata matches actual provider behavior; upgrade provider if metadata lies."],"tags":["oidc","code-flow","iss-parameter","discovery-metadata"],"backgroundTag":"missing-oidc-iss-parameter","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}