{"record":{"id":"f307594827a690d6","repo":"apereo/cas","slug":"invalid-request-f30759","errorCode":"invalid_request","errorMessage":"CAS cannot accept the authorization request given the issuer is invalid.","messagePattern":"CAS cannot accept the authorization request given the issuer is invalid\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/authorize/OidcAuthorizeEndpointController.java","lineNumber":44,"sourceCode":" * @since 5.0.0\n */\n@Slf4j\n@Tag(name = \"OpenID Connect\")\npublic class OidcAuthorizeEndpointController extends OAuth20AuthorizeEndpointController<OidcConfigurationContext> {\n    public OidcAuthorizeEndpointController(final OidcConfigurationContext configurationContext) {\n        super(configurationContext);\n    }\n\n    @GetMapping({\n        '/' + OidcConstants.BASE_OIDC_URL + '/' + OAuth20Constants.AUTHORIZE_URL,\n        \"/**/\" + OidcConstants.AUTHORIZE_URL\n    })\n    @Operation(summary = \"Handle OIDC authorization request\")\n    @Override\n    public ModelAndView handleRequest(final HttpServletRequest request, final HttpServletResponse response) throws Throwable {\n        val webContext = new JEEContext(request, response);\n        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.AUTHORIZE_URL, OAuth20Constants.AUTHORIZE_URL))) {\n            LOGGER.warn(\"CAS cannot accept the authorization request given the issuer is invalid.\");\n            return OAuth20Utils.writeError(response, OAuth20Constants.INVALID_REQUEST, \"Invalid issuer\");\n        }\n\n        if (getConfigurationContext().getDiscoverySettings().isRequirePushedAuthorizationRequests()\n            && webContext.getRequestURL().endsWith(OidcConstants.AUTHORIZE_URL)\n            && StringUtils.isBlank(request.getParameter(OidcConstants.REQUEST_URI))) {\n            LOGGER.warn(\"CAS is configured to only accept pushed authorization requests\");\n            return OAuth20Utils.produceUnauthorizedErrorView(HttpStatus.FORBIDDEN);\n        }\n\n        val scopes = getConfigurationContext().getRequestParameterResolver().resolveRequestedScopes(webContext);\n        if (scopes.isEmpty() || !scopes.contains(OidcConstants.StandardScopes.OPENID.getScope())) {\n            LOGGER.warn(\"Provided scopes [{}] are undefined by OpenID Connect, which requires that scope [{}] MUST be specified, \"\n                        + \"or the behavior is unspecified. CAS MAY allow this request to be processed for now.\",\n                scopes, OidcConstants.StandardScopes.OPENID.getScope());\n        }\n        return super.handleRequest(request, response);\n    }","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/authorize/OidcAuthorizeEndpointController.java#L26-L62","documentation":"The OIDC /authorize endpoint validates the request's issuer via the configured OidcIssuerService before processing. If the issuer cannot be validated against the authorize URLs (wrong host, mismatched cas.server/oidc issuer configuration), CAS writes an OAuth2 error 'invalid_request' with description 'Invalid issuer'.","triggerScenarios":"An authorization request whose request URL/host does not match the OIDC issuer configured in cas.authn.oidc.issuer (validated by validateIssuer against AUTHORIZE_URL paths).","commonSituations":"Accessing the server via a different hostname/scheme (localhost vs FQDN, http vs https) than encoded in cas.authn.oidc.issuer; running behind a reverse proxy that rewrites the Host header; issuer configured with trailing path differences.","solutions":["Set cas.authn.oidc.issuer to exactly match the externally visible base URL used by clients (scheme, host, port)","Fix reverse-proxy config to forward original Host/X-Forwarded-* headers so the issuer matches","Correct the URL clients use to reach the /oidc/authorize endpoint","Check OidcIssuerService bean customization if you have a custom issuer validation"],"exampleFix":"// before\ncas.authn.oidc.issuer=https://localhost:8443/cas/oidc   # but clients hit https://sso.example.org/cas/oidc\n// after\ncas.authn.oidc.issuer=https://sso.example.org/cas/oidc","handlingStrategy":"validation","validationCode":"const issuerUrl = new URL(casAuthnOidcIssuer);\nconst reqUrl = new URL(authorizeUrl);\nif (issuerUrl.origin !== reqUrl.origin || !reqUrl.pathname.startsWith(issuerUrl.pathname)) {\n  throw new Error(`Authorize URL host ${reqUrl.origin} does not match configured issuer ${issuerUrl.origin}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await cas.authorize(params);\n} catch (e) {\n  if (e.error === 'invalid_request' && /issuer/i.test(e.error_description ?? '')) {\n    // correct cas.authn.oidc.issuer or the client-facing URL and retry\n  }\n  throw e;\n}","preventionTips":["Keep cas.authn.oidc.issuer identical to the external URL clients use","Configure the reverse proxy to preserve Host/X-Forwarded headers","Document the single canonical CAS base URL","Test discovery + authorize through the same hostname clients use"],"tags":["oidc","issuer","invalid-request","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}