{"record":{"id":"f8ba199ee2da7815","repo":"spring-projects/spring-security","slug":"invalid-request-f8ba19","errorCode":"invalid_request","errorMessage":"OAuth 2.0 Parameter: request_uri","messagePattern":"OAuth 2\\.0 Parameter: request_uri","errorType":"error_code","errorClass":"OAuth2AuthorizationCodeRequestAuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java","lineNumber":138,"sourceCode":"\t\tthis.registeredClientRepository = registeredClientRepository;\n\t\tthis.authorizationService = authorizationService;\n\t\tthis.authorizationConsentService = authorizationConsentService;\n\t}\n\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tOAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication = (OAuth2AuthorizationCodeRequestAuthenticationToken) authentication;\n\n\t\tOAuth2Authorization pushedAuthorization = null;\n\t\tString requestUri = (String) authorizationCodeRequestAuthentication.getAdditionalParameters()\n\t\t\t.get(OAuth2ParameterNames.REQUEST_URI);\n\t\tif (StringUtils.hasText(requestUri)) {\n\t\t\tOAuth2PushedAuthorizationRequestUri pushedAuthorizationRequestUri;\n\t\t\ttry {\n\t\t\t\tpushedAuthorizationRequestUri = OAuth2PushedAuthorizationRequestUri.parse(requestUri);\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,\n\t\t\t\t\t\tauthorizationCodeRequestAuthentication, null);\n\t\t\t}\n\n\t\t\tpushedAuthorization = this.authorizationService.findByToken(pushedAuthorizationRequestUri.getState(),\n\t\t\t\t\tSTATE_TOKEN_TYPE);\n\t\t\tif (pushedAuthorization == null) {\n\t\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_REQUEST, OAuth2ParameterNames.REQUEST_URI,\n\t\t\t\t\t\tauthorizationCodeRequestAuthentication, null);\n\t\t\t}\n\n\t\t\tif (this.logger.isTraceEnabled()) {\n\t\t\t\tthis.logger.trace(\"Retrieved authorization with pushed authorization request\");\n\t\t\t}\n\n\t\t\tOAuth2AuthorizationRequest authorizationRequest = pushedAuthorization\n\t\t\t\t.getAttribute(OAuth2AuthorizationRequest.class.getName());\n\t\t\tAssert.notNull(authorizationRequest, \"authorizationRequest cannot be null\");\n","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java#L120-L156","documentation":"Thrown by OAuth2AuthorizationCodeRequestAuthenticationProvider.createException() when the authorization request carries a request_uri parameter (RFC 9126 Pushed Authorization Requests flow-through) that cannot be parsed into a valid OAuth2PushedAuthorizationRequestUri. The error is invalid_request naming the request_uri parameter.","triggerScenarios":"An /oauth2/authorize GET request includes request_uri=<value>, but the value does not start with the PAR prefix 'urn:ietf:params:oauth:request_uri:' or its suffix does not decode to a valid, non-expired PAR structure (state + expiresAt).","commonSituations":"Clients copying the full request_uri including surrounding quotes or whitespace; sending a truncated URL; hand-rolled clients constructing the request_uri instead of using the value returned by the PAR endpoint; URL-encoding issues stripping characters.","solutions":["Use the exact request_uri value returned in the PAR response (POST /oauth2/par), unmodified and correctly URL-encoded in the subsequent authorize redirect","Check the value begins with urn:ietf:params:oauth:request_uri: and the base64url-encoded suffix is intact","Regenerate the PAR request if the original value was altered or lost"],"exampleFix":"// before\nhttps://auth.example.com/oauth2/authorize?client_id=x&request_uri=abc123\n// after\nhttps://auth.example.com/oauth2/authorize?client_id=x&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Ab64encodedValue","handlingStrategy":"validation","validationCode":"if (requestUri == null || !requestUri.startsWith(\"urn:ietf:params:oauth:request_uri:\")) {\n    throw new IllegalArgumentException(\"malformed request_uri; use the value returned by the PAR endpoint verbatim\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    HttpResponse<String> resp = send(authorizeRedirect);\n} catch (OAuth2ErrorRedirectException | IOException ex) {\n    if (ex.getMessage().contains(\"request_uri\")) { /* re-run PAR and retry with fresh request_uri */ }\n}","preventionTips":["Pass the PAR response's request_uri through unchanged and correctly URL-encoded in the authorize redirect","Do not reconstruct or trim the request_uri string by hand","Add a client-side smoke test that runs the full PAR -> authorize flow"],"tags":["oauth2","par","request-uri","authorization-request"],"backgroundTag":"invalid-url-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}