spring-projects/spring-security · error · OAuth2AuthenticationException

Invalid Client Registration: + fieldName

Error message

Invalid Client Registration: + fieldName

What it means

Validation failure raised by OidcClientRegistrationAuthenticationValidator when a specific registration metadata field fails one of its strict validators. createException wraps the error code and field name (redirect_uris or scope) into an OAuth2AuthenticationException.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationValidator.java:300

				LOGGER.debug(LogMessage.format(
						"Invalid request: scope must not be set during Dynamic Client Registration ('%s')", scopes));
			}
			throw createException(OAuth2ErrorCodes.INVALID_SCOPE, OidcClientMetadataClaimNames.SCOPE);
		}
	}

	private static void validateScopeSimple(OidcClientRegistrationAuthenticationContext authenticationContext) {
		// No validation. Preserves prior behavior.
	}

	private static boolean isUnsafeScheme(String scheme) {
		return "javascript".equalsIgnoreCase(scheme) || "data".equalsIgnoreCase(scheme)
				|| "vbscript".equalsIgnoreCase(scheme);
	}

	private static OAuth2AuthenticationException createException(String errorCode, String fieldName) {
		OAuth2Error error = new OAuth2Error(errorCode, "Invalid Client Registration: " + fieldName, ERROR_URI);
		throw new OAuth2AuthenticationException(error);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Use fully-qualified absolute http/https URIs with no fragment for every redirect_uri
2. Remove any '#fragment' component from redirect URIs — fragments are forbidden by spec
3. Ensure jwks_uri is a well-formed absolute URL pointing to the client's JWK Set
4. Validate the scope string: space-separated tokens using allowed characters (no commas, no empty entries)

Example fix

// before
"redirect_uris": ["https://app.example.com/cb#section"]
// after
"redirect_uris": ["https://app.example.com/cb"]

static boolean isValidRedirectUri(String uri) {
    try {
        URI u = new URI(uri);
        return ("http".equals(u.getScheme()) || "https".equals(u.getScheme()))
            && u.isAbsolute() && u.getRawFragment() == null;
    } catch (URISyntaxException e) { return false; }
}
redirectUris.stream().allMatch(YourClass::isValidRedirectUri);

boolean isValidRedirectUri(URI u) {
    return u != null && u.isAbsolute()
        && (u.getScheme().equals("http") || u.getScheme().equals("https"))
        && u.getFragment() == null;
}

When it happens

Trigger: register a client where redirect_uris are not strictly valid (validateRedirectUrisStrict: non-absolute or non-http(s) URIs), contain a fragment (validateRedirectUrisFragmentOnly), jwks_uri is invalid (validateJwkSetUri), or scope contains invalid characters/entries (validateScope).

Common situations: Developers registering clients with localhost/plain-relative URIs, redirect URIs containing '#fragment', a jwks_uri that is not a valid https URL, or scopes with whitespace/illegal characters; also seen when front-ends URL-encode or truncate redirect URIs.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Invalid Client Registration: + fieldName
• Invalid Client Registration: + fieldName
• server_error
• invalid_request
• invalid_request

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/e30c357215e9591d. Report an issue: GitHub.