spring-projects/spring-security · error · HttpMessageNotReadableException

An error occurred reading the OAuth 2.0 Authorization Server

Error message

An error occurred reading the OAuth 2.0 Authorization Server Metadata: + ex.getMessage()

What it means

OAuth2AuthorizationServerMetadataHttpMessageConverter reads authorization-server metadata from an HTTP response body by delegating to an inner JSON converter, then converts the parameter map into an OAuth2AuthorizationServerMetadata. Any exception in either step is wrapped in an HttpMessageNotReadableException whose message embeds the underlying exception message, indicating the metadata document could not be read or validated.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/http/converter/OAuth2AuthorizationServerMetadataHttpMessageConverter.java:84

		this.jsonMessageConverter = converter;
	}

	@Override
	protected boolean supports(Class<?> clazz) {
		return OAuth2AuthorizationServerMetadata.class.isAssignableFrom(clazz);
	}

	@Override
	@SuppressWarnings("unchecked")
	protected OAuth2AuthorizationServerMetadata readInternal(Class<? extends OAuth2AuthorizationServerMetadata> clazz,
			HttpInputMessage inputMessage) throws HttpMessageNotReadableException {
		try {
			Map<String, Object> authorizationServerMetadataParameters = (Map<String, Object>) this.jsonMessageConverter
				.read(STRING_OBJECT_MAP.getType(), null, inputMessage);
			return this.authorizationServerMetadataConverter.convert(authorizationServerMetadataParameters);
		}
		catch (Exception ex) {
			throw new HttpMessageNotReadableException(
					"An error occurred reading the OAuth 2.0 Authorization Server Metadata: " + ex.getMessage(), ex,
					inputMessage);
		}
	}

	@Override
	protected void writeInternal(OAuth2AuthorizationServerMetadata authorizationServerMetadata,
			HttpOutputMessage outputMessage) throws HttpMessageNotWritableException {
		try {
			Map<String, Object> authorizationServerMetadataResponseParameters = this.authorizationServerMetadataParametersConverter
				.convert(authorizationServerMetadata);
			this.jsonMessageConverter.write(authorizationServerMetadataResponseParameters, STRING_OBJECT_MAP.getType(),
					MediaType.APPLICATION_JSON, outputMessage);
		}
		catch (Exception ex) {
			throw new HttpMessageNotWritableException(
					"An error occurred writing the OAuth 2.0 Authorization Server Metadata: " + ex.getMessage(), ex);
		}

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify the metadata endpoint URL is correct and returns valid JSON with the right content-type (application/json)
2. Inspect the wrapped cause (ex.getCause()/getMessage) to see the exact conversion failure and fix the served metadata accordingly
3. Check for proxies/gateways altering the response (HTML login/error pages) and exclude the metadata path
4. If you serve the metadata, ensure all required fields (issuer, token_endpoint, etc.) are present with correct types

Example fix

// before: wrong endpoint
String uri = "https://auth.example.com/.well-known/openid-configuration/mistyped";
// after: correct well-known URI for OAuth2 AS metadata
String uri = issuer + "/.well-known/oauth-authorization-server";
OAuth2AuthorizationServerMetadata metadata = rest.getForObject(uri, OAuth2AuthorizationServerMetadata.class);

// fetch and sanity-check the metadata JSON before converting
const resp = await fetch(metadataUrl);
const contentType = resp.headers.get('content-type') || '';
if (!contentType.includes('application/json')) {
  throw new Error(`Expected JSON metadata, got ${contentType}`);
}

try {
  metadata = converter.read(OAuth2AuthorizationServerMetadata.class, inputMessage);
} catch (HttpMessageNotReadableException e) {
  throw new IllegalStateException(
    "Authorization server metadata unreadable: " + e.getMessage() +
    " — verify the well-known URI returns valid JSON", e);
}

When it happens

Trigger: Fetching the authorization server metadata (/.well-known/oauth-authorization-server or openid-configuration) when the response body is not a JSON object, contains invalid JSON, or is missing/has invalid required metadata parameters.

Common situations: Misconfigured issuer URL returning an HTML error page instead of JSON; proxy/firewall intercepting the request; server emitting metadata with wrong types (e.g. string where boolean expected) that fails the metadata converter; wrong content-type from the server.

Understand the failure class

Background: "Invalid JSON response" and "Failed to parse response" errors: when an API answers 200 but the body isn't the JSON your library expected — this error's family across 28 libraries.

Related errors

• An error occurred reading the OpenID Client Registration: ${
• An error occurred writing the OpenID Client Registration: ${
• An error occurred reading the OpenID Provider Configuration:
• An error occurred writing the OpenID Provider Configuration:
• An error occurred reading the UserInfo response: ${ex.getMes

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/db045f4d7c1cee9d. Report an issue: GitHub.