spring-projects/spring-security · error · OAuth2AuthenticationException

invalid_request

invalid_request

Error message

invalid_request

What it means

This OAuth2AuthenticationException with code invalid_request is thrown by OAuth2ClientAuthenticationFilter.validateClientIdentifier when the authenticated client_id contains characters outside the printable ASCII range (32-126). The filter rejects non-printable or non-ASCII characters in client identifiers to prevent parsing/injection issues in token endpoint authentication.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilter.java:243

	}

	private static void validateClientIdentifier(Authentication authentication) {
		if (!(authentication instanceof OAuth2ClientAuthenticationToken)) {
			return;
		}

		// As per spec, in Appendix A.1.
		// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#appendix-A.1
		// The syntax for client_id is *VSCHAR (%x20-7E):
		// -> Hex 20 -> ASCII 32 -> space
		// -> Hex 7E -> ASCII 126 -> tilde

		OAuth2ClientAuthenticationToken clientAuthentication = (OAuth2ClientAuthenticationToken) authentication;
		String clientId = (String) clientAuthentication.getPrincipal();
		for (int i = 0; i < clientId.length(); i++) {
			char charAt = clientId.charAt(i);
			if (!(charAt >= 32 && charAt <= 126)) {
				throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
			}
		}
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Inspect and sanitize the client_id sent by the client to contain only printable ASCII
2. Remove hidden/invisible characters (BOM, zero-width spaces) from configuration
3. Re-register the client with a plain ASCII identifier if the stored clientId is non-ASCII
4. Log the offending client_id characters to find where the non-ASCII value originates

Example fix

// before: client_id with hidden characters
String clientId = "my\u200Bclient";
// after: sanitize before sending
String clientId = requestClientId.replaceAll("[^\\x20-\\x7E]", "");

// Validate client_id is printable ASCII before sending it
if (!clientId.chars().allMatch(c -> c >= 32 && c <= 126)) {
    throw new IllegalArgumentException("client_id must be printable ASCII");
}

boolean isPrintableAscii(String s) {
    return s != null && s.chars().allMatch(c -> c >= 32 && c <= 126);
}

try {
    // token endpoint call
} catch (OAuth2AuthenticationException e) {
    if ("invalid_request".equals(e.getError().getErrorCode())) {
        logger.error("client_id rejected; check for non-ASCII/control characters");
    }
}

When it happens

Trigger: A token endpoint request whose client_id (after client authentication resolution) contains control characters, unicode, or other chars below 32 or above 126.

Common situations: Client sending a client_id copied with hidden unicode characters (zero-width spaces, BOM); misconfigured identity provider injecting non-ASCII identifiers; URL-encoded values decoded into non-ASCII characters.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• invalid_request
• INVALID_CLIENT
• invalid_request
• invalid_request
• invalid_request

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/9dff7c92b2b8558f. Report an issue: GitHub.