spring-projects/spring-security · error · OAuth2AuthorizationCodeRequestAuthenticationException

OAuth 2.0 Parameter: ${parameterName}

Error message

OAuth 2.0 Parameter: ${parameterName}

What it means

OAuth2AuthorizationConsentAuthenticationConverter throws OAuth2AuthorizationCodeRequestAuthenticationException with description "OAuth 2.0 Parameter: <parameterName>" when a request to the authorization consent endpoint lacks required parameters (client_id and scope are mandatory) or carries malformed values. The converter validates the incoming consent/authorization request before it reaches the consent service, failing fast with the offending parameter in the error description.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationConsentAuthenticationConverter.java:126

			}
		});

		return new OAuth2AuthorizationConsentAuthenticationToken(authorizationUri, clientId, principal, state, scopes,
				additionalParameters);
	}

	static RequestMatcher createDefaultRequestMatcher() {
		return (request) -> "POST".equals(request.getMethod())
				&& request.getParameter(OAuth2ParameterNames.RESPONSE_TYPE) == null
				&& request.getParameter(OAuth2ParameterNames.REQUEST_URI) == null
				&& request.getParameter(OAuth2ParameterNames.REDIRECT_URI) == null
				&& request.getParameter(PkceParameterNames.CODE_CHALLENGE) == null
				&& request.getParameter(PkceParameterNames.CODE_CHALLENGE_METHOD) == null;
	}

	private static void throwError(String errorCode, String parameterName) {
		OAuth2Error error = new OAuth2Error(errorCode, "OAuth 2.0 Parameter: " + parameterName, DEFAULT_ERROR_URI);
		throw new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

  1. Read the OAuth2Error description to see which parameter was flagged and include it in the consent request.
  2. Ensure the consent form submits client_id and scope (one or more scope values) back to the consent endpoint.
  3. Verify the consent page is only rendered/reached in the context of a valid authorization request that supplies code, code_challenge, or code_challenge_method parameters when PKCE is in play.
  4. Use the default consent page (oauth2ConsentPage) or match its form field names exactly in a custom page.

Example fix

// before: consent form missing required fields
<form method="post" action="/oauth2/consent">
  <button type="submit">Approve</button>
</form>
// after
<form method="post" action="/oauth2/consent">
  <input type="hidden" name="client_id" th:value="${clientId}"/>
  <input type="hidden" name="scope" th:value="openid"/>
  <input type="hidden" name="state" th:value="${state}"/>
  <button type="submit">Approve</button>
</form>
Defensive patterns

Strategy: validation

Validate before calling

function validateConsentSubmission(form) {
  const errors = [];
  if (!form.get('client_id')) errors.push('client_id is required');
  if (!form.getAll('scope').length) errors.push('at least one scope is required');
  return errors;
}
const errs = validateConsentSubmission(new FormData(consentForm));
if (errs.length) { alert('Fix form: ' + errs.join('; ')); return; }

Type guard

function isConsentFormComplete(f) {
  return f instanceof FormData
    && typeof f.get('client_id') === 'string' && f.get('client_id').length > 0
    && f.getAll('scope').every(s => typeof s === 'string' && s.length > 0);
}

Try / catch

try {
  consentResult = submitConsent(clientId, scopes, state);
} catch (OAuth2AuthorizationCodeRequestAuthenticationException e) {
  OAuth2Error err = e.getError();
  logger.warn("Consent request rejected: {}", err.getDescription());
  // re-render consent page with the flagged parameter highlighted
}

Prevention

When it happens

Trigger: convert() calls throwError() when the consent endpoint request is missing client_id or scope, when the request method is not GET/POST as required, or when neither an authorization-consent payload nor a PKCE-eligible authorization code request is detectable (no code, code_challenge, or code_challenge_method parameters).

Common situations: A custom consent UI posts the consent form but omits the hidden client_id or scope inputs; a template renames form fields; a client submits consent without an active authorization transaction (no code/challenge parameters); version upgrades change which parameters the consent flow requires.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b29550fb8eb91fc4. Report an issue: GitHub.