spring-projects/spring-security · error · OAuth2AuthenticationException

Invalid Client Registration: + fieldName

Error message

Invalid Client Registration: + fieldName

What it means

OAuth2ClientRegistrationAuthenticationValidator throws this when a client registration parameter in an OAuth2ClientRegistrationAuthenticationToken fails validation, e.g. redirect URIs using forbidden schemes (javascript:, data:, vbscript:), an invalid jwkSetUri, or an invalid requested scope. The message is 'Invalid Client Registration: <fieldName>' where fieldName identifies the offending registration property.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientRegistrationAuthenticationValidator.java:240

				LOGGER.debug(LogMessage.format(
						"Invalid request: scope must not be set during Dynamic Client Registration ('%s')", scopes));
			}
			throw createException(OAuth2ErrorCodes.INVALID_SCOPE, OAuth2ClientMetadataClaimNames.SCOPE);
		}
	}

	private static void validateScopeSimple(OAuth2ClientRegistrationAuthenticationContext authenticationContext) {
		// No validation. Preserves prior behavior.
	}

	private static boolean isUnsafeScheme(String scheme) {
		return "javascript".equalsIgnoreCase(scheme) || "data".equalsIgnoreCase(scheme)
				|| "vbscript".equalsIgnoreCase(scheme);
	}

	private static OAuth2AuthenticationException createException(String errorCode, String fieldName) {
		OAuth2Error error = new OAuth2Error(errorCode, "Invalid Client Registration: " + fieldName, ERROR_URI);
		throw new OAuth2AuthenticationException(error);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Fix the redirect_uri values: use standard schemes (https, or http://127.0.0.1 loopback, or custom app scheme) and remove javascript:/data:/vbscript: URIs.
2. Correct the jwk_set_uri to an absolute https:// URL pointing to the client's JWKS endpoint.
3. Fix the requested scope: use only allowed characters (per RegisteredClient.withScopes / Scope validation) and no leading/trailing whitespace.
4. Catch OAuth2AuthenticationException in the registration endpoint and return the OAuth2Error details to the registering client.

Example fix

// before
Map<String, Object> meta = Map.of("redirect_uris", List.of("javascript:void(0)"));
// after
Map<String, Object> meta = Map.of("redirect_uris", List.of("https://client.example.com/callback"));

for (String uri : redirectUris) {
    URI u = URI.create(uri);
    String scheme = u.getScheme();
    if (scheme == null || scheme.equalsIgnoreCase("javascript")
            || scheme.equalsIgnoreCase("data") || scheme.equalsIgnoreCase("vbscript")) {
        throw new IllegalArgumentException("Forbidden redirect URI scheme: " + uri);
    }
}

try {
    clientRegistrationService.save(registeredClient);
} catch (OAuth2AuthenticationException e) {
    log.error("Client registration rejected: {}", e.getError().getDescription());
    return ResponseEntity.badRequest().body(e.getError());
}

When it happens

Trigger: Dynamic client registration (RFC 7591) request containing: a redirect_uri whose scheme is javascript/data/vbscript (validateRedirectUris / validateRedirectUrisSimple), a jwkSetUri that is not a valid absolute HTTPS URL (validateJwkSetUri), or a scope string that fails the RegisteredClient scope validation (validateScope).

Common situations: Dev/test clients registering 'http://localhost' or browser-friendly redirect URIs like 'javascript:...' for SPA flows; typos in jwkSetUri (missing https, relative URL); scope names containing illegal characters or exceeding size limits during automated client provisioning.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid Client Registration: + fieldName
• Invalid Client Registration: + fieldName
• invalid_client_metadata
• OAuth 2.0 Parameter: + parameterName
• server_error

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/5d87e06369c33d01. Report an issue: GitHub.