spring-projects/spring-security · error · HttpMessageNotWritableException

An error occurred writing the OAuth 2.0 Device Authorization

Error message

An error occurred writing the OAuth 2.0 Device Authorization Response: ${ex.getMessage()}

What it means

This HttpMessageNotWritableException is thrown by OAuth2DeviceAuthorizationResponseHttpMessageConverter.writeInternal when the OAuth2DeviceAuthorizationResponse object cannot be converted to its Map of parameters or serialized to JSON. It wraps any exception from the parameters converter or the JSON message converter during serialization.

Source

Thrown at oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/http/converter/OAuth2DeviceAuthorizationResponseHttpMessageConverter.java:106

		catch (Exception ex) {
			throw new HttpMessageNotReadableException(
					"An error occurred reading the OAuth 2.0 Device Authorization Response: " + ex.getMessage(), ex,
					inputMessage);
		}
	}

	@Override
	protected void writeInternal(OAuth2DeviceAuthorizationResponse deviceAuthorizationResponse,
			HttpOutputMessage outputMessage) throws HttpMessageNotWritableException {

		try {
			Map<String, Object> deviceAuthorizationResponseParameters = this.deviceAuthorizationResponseParametersConverter
				.convert(deviceAuthorizationResponse);
			this.jsonMessageConverter.write(deviceAuthorizationResponseParameters, STRING_OBJECT_MAP.getType(),
					MediaType.APPLICATION_JSON, outputMessage);
		}
		catch (Exception ex) {
			throw new HttpMessageNotWritableException(
					"An error occurred writing the OAuth 2.0 Device Authorization Response: " + ex.getMessage(), ex);
		}
	}

	/**
	 * Sets the {@link Converter} used for converting the OAuth 2.0 Device Authorization
	 * Response parameters to an {@link OAuth2DeviceAuthorizationResponse}.
	 * @param deviceAuthorizationResponseConverter the {@link Converter} used for
	 * converting to an {@link OAuth2DeviceAuthorizationResponse}
	 */
	public final void setDeviceAuthorizationResponseConverter(
			Converter<Map<String, Object>, OAuth2DeviceAuthorizationResponse> deviceAuthorizationResponseConverter) {
		Assert.notNull(deviceAuthorizationResponseConverter, "deviceAuthorizationResponseConverter cannot be null");
		this.deviceAuthorizationResponseConverter = deviceAuthorizationResponseConverter;
	}

	/**
	 * Sets the {@link Converter} used for converting the

View on GitHub (pinned to 96852e8860)

Solutions

Check the wrapped cause (ex.getCause()) for the concrete failure.
Ensure a Jackson-based MappingJackson2HttpMessageConverter is set via setJsonMessageConverter and Jackson is on the classpath.
If a custom parametersConverter was set, verify it handles null fields and produces Map<String,Object>.
Catch HttpMessageNotWritableException around the converter call and write a structured error response.

Example fix

// before
converter.write(response, MediaType.APPLICATION_JSON, outputMessage);
// after
try {
    converter.write(response, MediaType.APPLICATION_JSON, outputMessage);
} catch (HttpMessageNotWritableException ex) {
    logger.error("Device authorization response write failed", ex.getCause());
}

Defensive patterns

Strategy: try-catch

Try / catch

try {
    converter.write(response, MediaType.APPLICATION_JSON, outputMessage);
} catch (HttpMessageNotWritableException ex) {
    logger.error("Device auth response write failed", ex.getCause());
}

Prevention

Ensure Jackson is on the classpath and a MappingJackson2HttpMessageConverter is configured.
Test serialization of OAuth2DeviceAuthorizationResponse with null optional fields.
Handle client-disconnect IOExceptions upstream so they don't surface mid-write.

When it happens

Trigger: Calling writeInternal/write on an OAuth2DeviceAuthorizationResponseHttpMessageConverter when OAuth2DeviceAuthorizationResponseParametersConverter fails or jsonMessageConverter.write fails (e.g. no Jackson converter registered, IOException writing to output stream).

Common situations: Missing Jackson on the classpath so no JSON converter is configured, a custom parameters converter that throws, or the underlying HttpOutputMessage body stream is broken (client disconnected).

Understand the failure class

Background: "JSON serialization failed", "not JSON serializable", "Failed to serialize": why JSON marshaling errors happen and how to fix them — this error's family across 46 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/804e631afe42c44f. Report an issue: GitHub.