spring-projects/spring-security · error · HttpMessageNotReadableException

An error occurred reading the UserInfo response: ${ex.getMes

Error message

An error occurred reading the UserInfo response: ${ex.getMessage()}

What it means

This HttpMessageNotReadableException is thrown by OidcUserInfoHttpMessageConverter.readInternal when reading the UserInfo response fails. Either the JSON body cannot be parsed into a Map by the jsonMessageConverter, or the resulting parameters fail the OidcUserInfoConverter validation. The underlying exception message is appended for diagnosis.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcUserInfoHttpMessageConverter.java:83

		this.jsonMessageConverter = converter;
	}

	@Override
	protected boolean supports(Class<?> clazz) {
		return OidcUserInfo.class.isAssignableFrom(clazz);
	}

	@Override
	@SuppressWarnings("unchecked")
	protected OidcUserInfo readInternal(Class<? extends OidcUserInfo> clazz, HttpInputMessage inputMessage)
			throws HttpMessageNotReadableException {
		try {
			Map<String, Object> userInfoParameters = (Map<String, Object>) this.jsonMessageConverter
				.read(STRING_OBJECT_MAP.getType(), null, inputMessage);
			return this.userInfoConverter.convert(userInfoParameters);
		}
		catch (Exception ex) {
			throw new HttpMessageNotReadableException(
					"An error occurred reading the UserInfo response: " + ex.getMessage(), ex, inputMessage);
		}
	}

	@Override
	protected void writeInternal(OidcUserInfo oidcUserInfo, HttpOutputMessage outputMessage)
			throws HttpMessageNotWritableException {
		try {
			Map<String, Object> userInfoResponseParameters = this.userInfoParametersConverter.convert(oidcUserInfo);
			this.jsonMessageConverter.write(userInfoResponseParameters, STRING_OBJECT_MAP.getType(),
					MediaType.APPLICATION_JSON, outputMessage);
		}
		catch (Exception ex) {
			throw new HttpMessageNotWritableException(
					"An error occurred writing the UserInfo response: " + ex.getMessage(), ex);
		}
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Inspect the wrapped cause message to see whether it was JSON parsing or UserInfo validation
2. Verify the UserInfo endpoint actually returns application/json with a valid JSON object
3. Ensure the response includes the required 'sub' claim per the OIDC spec
4. Log/capture the raw response body to confirm what the server returned

Example fix

// before: assuming UserInfo always succeeds
OidcUserInfo userInfo = restTemplate.getForObject(...);
// after: guard against bad responses
if (!response.getHeaders().getContentType().isCompatibleWith(MediaType.APPLICATION_JSON)) {
    throw new IllegalStateException("UserInfo endpoint returned non-JSON: " + response.getBody());
}

// Before relying on UserInfo, verify the response is a JSON object with 'sub'
if (body == null || !body.startsWith("{")) throw new IllegalStateException("UserInfo not JSON");
if (!body.contains("\"sub\"")) throw new IllegalStateException("UserInfo missing sub claim");

boolean isValidUserInfoResponse(Map<String,Object> params) {
    return params != null && params.get("sub") instanceof String s && !s.isEmpty();
}

try {
    OidcUser user = oidcUserService.loadUser(userRequest);
} catch (OAuth2AuthenticationException | InvalidBearerTokenException e) {
    // inspect cause for 'An error occurred reading the UserInfo response'
    logger.error("UserInfo read failed: {}", e.getCause());
}

When it happens

Trigger: Calling OidcUserService/UserInfo endpoint processing where the UserInfo endpoint returns malformed JSON, an error payload, or parameters that fail OidcUserInfoConverter validation (e.g. missing 'sub' claim).

Common situations: Upstream UserInfo endpoint returns HTML error pages, empty bodies, or non-standard claims; network proxies intercept the response; OIDC provider returns an error response with 200-shaped parsing expectations.

Understand the failure class

Background: "Invalid JSON response" and "Failed to parse response" errors: when an API answers 200 but the body isn't the JSON your library expected — this error's family across 28 libraries.

Related errors

• An error occurred writing the UserInfo response: ${ex.getMes
• An error occurred writing the OpenID Provider Configuration:
• An error occurred reading the OAuth 2.0 Authorization Server
• An error occurred reading the OpenID Client Registration: ${
• An error occurred writing the OpenID Client Registration: ${

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b1fd21a098ff05bd. Report an issue: GitHub.