{"record":{"id":"f1c2557fd0a0b20c","repo":"thephpleague/oauth2-server","slug":"invalid-request-f1c255","errorCode":"invalid_request","errorMessage":"The request is missing a required parameter, is invalid, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the \"client_id\" parameter","messagePattern":"The request is missing a required parameter, is invalid, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed\\. Check the \"client_id\" parameter","errorType":"http","errorClass":"OAuthServerException","httpStatus":400,"severity":"error","filePath":"src/Grant/ImplicitGrant.php","lineNumber":103,"sourceCode":"        return (\n            $request->getQueryParams()['response_type'] === 'token'\n            && isset($request->getQueryParams()['client_id'])\n        );\n    }\n\n    /**\n     * {@inheritdoc}\n     */\n    public function validateAuthorizationRequest(ServerRequestInterface $request): AuthorizationRequestInterface\n    {\n        $clientId = $this->getQueryStringParameter(\n            'client_id',\n            $request,\n            $this->getServerParameter('PHP_AUTH_USER', $request)\n        );\n\n        if (is_null($clientId)) {\n            throw OAuthServerException::invalidRequest('client_id');\n        }\n\n        $client = $this->getClientEntityOrFail($clientId, $request);\n\n        $redirectUri = $this->getQueryStringParameter('redirect_uri', $request);\n\n        if ($redirectUri !== null) {\n            $this->validateRedirectUri($redirectUri, $client, $request);\n        } elseif (\n            $client->getRedirectUri() === '' ||\n            (is_array($client->getRedirectUri()) && count($client->getRedirectUri()) !== 1)\n        ) {\n            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));\n            throw OAuthServerException::invalidClient($request);\n        }\n\n        $stateParameter = $this->getQueryStringParameter('state', $request);\n","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/Grant/ImplicitGrant.php#L85-L121","documentation":"ImplicitGrant::validateAuthorizationRequest throws invalid_request for the 'client_id' parameter when no client id can be resolved from the query string or HTTP Basic auth (PHP_AUTH_USER). Per RFC 6749 the authorization endpoint requires client_id, so an authorization request without one cannot proceed.","triggerScenarios":"GET to the authorization endpoint via validateAuthorizationRequest with neither ?client_id= in the query string nor PHP_AUTH_USER set in the request; getServerParameter/getQueryStringParameter return null and OAuthServerException::invalidRequest('client_id') is thrown.","commonSituations":"Frontend redirects users to /authorize but drops the client_id query parameter; template/URL-building bug; reverse proxy strips query params; developer relies on HTTP Basic auth that the browser/client never sends.","solutions":["Append client_id to the authorization URL: /authorize?response_type=token&client_id=YOUR_ID&redirect_uri=...","If using HTTP Basic auth, confirm the client actually sends the Authorization header (curl -u client_id:secret)","Check your redirect/link generation and any proxy rewrite rules that may strip query strings","Validate the outgoing authorization request in tests before shipping"],"exampleFix":"// before\nheader('Location: /authorize?response_type=token&redirect_uri=' . $uri);\n// after\nheader('Location: /authorize?response_type=token&client_id=' . urlencode($clientId) . '&redirect_uri=' . urlencode($uri));","handlingStrategy":"validation","validationCode":"const authUrl = new URL('/authorize', baseUrl);\nif (!authUrl.searchParams.get('client_id')) {\n    throw new Error('client_id must be present in the authorization URL');\n}","typeGuard":"function hasClientId(ServerRequestInterface $r): bool {\n    return $r->getQueryParams()['client_id'] !== null\n        || $r->getServerParams()['PHP_AUTH_USER'] !== null;\n}","tryCatchPattern":"try {\n    $authRequest = $server->validateAuthorizationRequest($request);\n} catch (OAuthServerException $e) {\n    if (str_contains($e->getMessage(), 'client_id')) {\n        return redirect('/login?error=missing_client_id');\n    }\n    throw $e;\n}","preventionTips":["Generate authorization links from a single template that always includes client_id","Add an integration test asserting the /authorize URL contains client_id","Check reverse-proxy rewrite rules do not strip query strings"],"tags":["oauth2","implicit-grant","authorization-endpoint","php"],"backgroundTag":"missing-required-argument","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}