spring-projects/spring-security · error

Authorization Request failed: %s

Error message

Authorization Request failed: %s

What it means

OAuth2AuthorizationRequestRedirectFilter.unsuccessfulRedirectForAuthorization handles exceptions thrown while building/redirecting the OAuth2 authorization request. It logs "Authorization Request failed: <cause>" at WARN level when the cause is InvalidClientRegistrationIdException (unknown registrationId) and at ERROR level otherwise, then sends an HTTP 500 to the client. The actual failure is in the cause, e.g. the client registration id in the request URL does not match any registered ClientRegistration.

Source

Thrown at oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2AuthorizationRequestRedirectFilter.java:248

	private void sendRedirectForAuthorization(HttpServletRequest request, HttpServletResponse response,
			OAuth2AuthorizationRequest authorizationRequest) throws IOException {
		if (AuthorizationGrantType.AUTHORIZATION_CODE.equals(authorizationRequest.getGrantType())) {
			this.authorizationRequestRepository.saveAuthorizationRequest(authorizationRequest, request, response);
		}
		this.authorizationRedirectStrategy.sendRedirect(request, response,
				authorizationRequest.getAuthorizationRequestUri());
	}

	private void unsuccessfulRedirectForAuthorization(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException ex) throws IOException {
		Throwable cause = ex.getCause();
		if (cause != null) {
			LogMessage message = LogMessage.format("Authorization Request failed: %s", cause);
			if (InvalidClientRegistrationIdException.class.isAssignableFrom(cause.getClass())) {
				// Log an invalid registrationId at WARN level to allow these errors to be
				// tuned separately from other errors
				this.logger.warn(message, ex);
			}
			else {
				this.logger.error(message, ex);
			}
		}
		response.sendError(HttpStatus.INTERNAL_SERVER_ERROR.value(),
				HttpStatus.INTERNAL_SERVER_ERROR.getReasonPhrase());
	}

	private static final class DefaultThrowableAnalyzer extends ThrowableAnalyzer {

		@Override
		protected void initExtractorMap() {
			super.initExtractorMap();
			registerExtractor(ServletException.class, (throwable) -> {
				ThrowableAnalyzer.verifyThrowableHierarchy(throwable, ServletException.class);
				return ((ServletException) throwable).getRootCause();
			});

View on GitHub (pinned to 96852e8860)

Solutions

1. Check the logged cause; if InvalidClientRegistrationIdException, fix the registrationId in the link to match a registered client.
2. Verify spring.security.oauth2.client.registration.* properties (or ClientRegistrationRepository bean) include that registrationId.
3. If using OIDC discovery, confirm the app can fetch {issuer}/.well-known/openid-configuration at startup.
4. Handle the exception via failureHandler customization if you want a friendlier redirect than a 500.

Example fix

// before: bad link
<a href="/oauth2/authorization/gogle">Login</a>
// after: matches registered client 'google'
<a href="/oauth2/authorization/google">Login</a>

// verify registrationId resolves before rendering links
ClientRegistration reg = clientRegistrationRepository
    .findByRegistrationId("google");
if (reg == null) {
    throw new IllegalStateException("Unknown registrationId: google");
}

try {
    chain.doFilter(req, res);
} catch (ClientRegistrationException e) {
    response.sendRedirect("/login?error=registration"); // custom failure handling
}

When it happens

Trigger: A request to the authorization endpoint (default /oauth2/authorization/{registrationId}) with a registrationId that has no matching ClientRegistration, or an unexpected exception during authorization-request construction/redirect.

Common situations: Typo in the registrationId in a login link; client registration beans not loaded (missing issuer URI resolution at startup, network failure fetching OIDC metadata); misconfigured oauth2 client properties; upstream issuer metadata unavailable at request time.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• INVALID_CLIENT
• invalid_request
• Invalid Client Registration with Id: ${registrationId}
• invalid_request
• invalid_scope

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/466a904ab2bed069. Report an issue: GitHub.