spring-projects/spring-security · error · HttpMessageNotReadableException

An error occurred reading the OAuth 2.0 Error: ${ex.getMessa

Error message

An error occurred reading the OAuth 2.0 Error: ${ex.getMessage()}

What it means

This HttpMessageNotReadableException is thrown by OAuth2ErrorHttpMessageConverter.readInternal when the incoming JSON error payload cannot be read or converted into an OAuth2Error. It wraps failures from the JSON converter or from converting the parameter map into a Map<String,String> of error parameters (error, error_description, error_uri).

Source

Thrown at oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/http/converter/OAuth2ErrorHttpMessageConverter.java:87

	protected boolean supports(Class<?> clazz) {
		return OAuth2Error.class.isAssignableFrom(clazz);
	}

	@Override
	@SuppressWarnings("unchecked")
	protected OAuth2Error readInternal(Class<? extends OAuth2Error> clazz, HttpInputMessage inputMessage)
			throws HttpMessageNotReadableException {
		try {
			// gh-8157: Parse parameter values as Object in order to handle potential JSON
			// Object and then convert values to String
			Map<String, Object> errorParameters = (Map<String, Object>) this.jsonMessageConverter
				.read(STRING_OBJECT_MAP.getType(), null, inputMessage);
			return this.errorConverter.convert(errorParameters.entrySet()
				.stream()
				.collect(Collectors.toMap(Map.Entry::getKey, (entry) -> String.valueOf(entry.getValue()))));
		}
		catch (Exception ex) {
			throw new HttpMessageNotReadableException(
					"An error occurred reading the OAuth 2.0 Error: " + ex.getMessage(), ex, inputMessage);
		}
	}

	@Override
	protected void writeInternal(OAuth2Error oauth2Error, HttpOutputMessage outputMessage)
			throws HttpMessageNotWritableException {
		try {
			Map<String, String> errorParameters = this.errorParametersConverter.convert(oauth2Error);
			this.jsonMessageConverter.write(errorParameters, STRING_OBJECT_MAP.getType(), MediaType.APPLICATION_JSON,
					outputMessage);
		}
		catch (Exception ex) {
			throw new HttpMessageNotWritableException(
					"An error occurred writing the OAuth 2.0 Error: " + ex.getMessage(), ex);
		}
	}

View on GitHub (pinned to 96852e8860)

Solutions

  1. Inspect ex.getCause() to see the underlying parse/conversion failure.
  2. Confirm the failing endpoint returns an RFC 6749 error JSON object like {"error":"invalid_grant"}.
  3. Check the request reached the correct OAuth endpoint (not an HTML login page or 404).
  4. Ensure a JSON message converter (Jackson) is configured on the converter.
  5. Handle it by wrapping into OAuth2AuthorizationException downstream instead of failing hard.

Example fix

// before
OAuth2Error error = converter.read(OAuth2Error.class, inputMessage);
// after
try {
    OAuth2Error error = converter.read(OAuth2Error.class, inputMessage);
} catch (HttpMessageNotReadableException ex) {
    logger.warn("OAuth2 error response not readable", ex.getCause());
}
Defensive patterns

Strategy: try-catch

Validate before calling

if (body == null || !body.strip().startsWith("{")) {
    throw new IllegalArgumentException("Expected a JSON error object body");
}

Try / catch

try {
    OAuth2Error error = converter.read(OAuth2Error.class, inputMessage);
} catch (HttpMessageNotReadableException ex) {
    logger.warn("OAuth2 error body unreadable", ex.getCause());
    return new OAuth2Error("server_error", "Malformed error response", null);
}

Prevention

When it happens

Trigger: Calling readInternal/read on an OAuth2ErrorHttpMessageConverter when the body is not valid JSON, not an object, or the stream read throws (connection closed mid-body).

Common situations: The token/revocation endpoint returns a non-JSON error page (proxy, wrong endpoint), or the response body is empty/garbage when handling an OAuth error response.

Understand the failure class

Background: "Invalid JSON response" and "Failed to parse response" errors: when an API answers 200 but the body isn't the JSON your library expected — this error's family across 28 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8931390ce17a2406. Report an issue: GitHub.