spring-projects/spring-security · error · OAuth2AuthorizationCodeRequestAuthenticationException

SERVER_ERROR

SERVER_ERROR

Error message

The token generator failed to generate the authorization code.

What it means

In OAuth2AuthorizationCodeRequestAuthenticationProvider.authenticate (the authorization endpoint), the configured OAuth2AuthorizationCodeGenerator (or generator chain) is invoked to create the authorization code. If it returns null — no generator supports the context — the provider throws OAuth2AuthorizationCodeRequestAuthenticationException with this SERVER_ERROR message.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java:311

			Set<String> currentAuthorizedScopes = (currentAuthorizationConsent != null)
					? currentAuthorizationConsent.getScopes() : null;

			Map<String, Object> additionalParameters = new HashMap<>();
			if (pushedAuthorization != null) {
				additionalParameters.put(OAuth2ParameterNames.SCOPE, authorizationRequest.getScopes());
			}

			return new OAuth2AuthorizationConsentAuthenticationToken(authorizationRequest.getAuthorizationUri(),
					registeredClient.getClientId(), principal, state, currentAuthorizedScopes, additionalParameters);
		}

		OAuth2TokenContext tokenContext = createAuthorizationCodeTokenContext(authorizationCodeRequestAuthentication,
				registeredClient, null, authorizationRequest.getScopes());
		OAuth2AuthorizationCode authorizationCode = this.authorizationCodeGenerator.generate(tokenContext);
		if (authorizationCode == null) {
			OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,
					"The token generator failed to generate the authorization code.", ERROR_URI);
			throw new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);
		}

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Generated authorization code");
		}

		OAuth2Authorization authorization = authorizationBuilder(registeredClient, principal, authorizationRequest)
			.authorizedScopes(authorizationRequest.getScopes())
			.token(authorizationCode)
			.build();
		this.authorizationService.save(authorization);

		if (this.logger.isTraceEnabled()) {
			this.logger.trace("Saved authorization");
		}

		if (pushedAuthorization != null) {
			// Enforce one-time use by removing the pushed authorization request

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure the default OAuth2AuthorizationCodeGenerator is registered (or include it in your composite via OAuth2ConfigurerUtils.getAuthorizationCodeGenerator).
2. Fix custom OAuth2AuthorizationCodeGenerator.generate() so it returns a non-null OAuth2AuthorizationCode for valid contexts.
3. Check generator delegation: return null only when another generator downstream will handle the context.
4. Re-enable default authorization server config if the generator bean was accidentally removed.

Example fix

// before
@Bean
OAuth2TokenGenerator<?> authorizationCodeGenerator() {
    return context -> null; // always fails
}

// after
@Bean
OAuth2TokenGenerator<?> authorizationCodeGenerator() {
    return new OAuth2AuthorizationCodeGenerator();
}

OAuth2AuthorizationCode code = authorizationCodeGenerator.generate(codeContext);
if (code == null) {
    throw new IllegalStateException("Authorization code generator returned null; check bean wiring");
}

try {
    // GET /oauth2/authorization?...
} catch (OAuth2AuthorizationCodeRequestAuthenticationException ex) {
    if (OAuth2ErrorCodes.SERVER_ERROR.equals(ex.getError().getErrorCode())) {
        log.error("Authorization code generator misconfigured: {}", ex.getError().getDescription());
    }
    throw ex;
}

When it happens

Trigger: A client hits the /oauth2/authorization endpoint to start the authorization code flow, but the OAuth2AuthorizationCodeGenerator bean is missing, misconfigured, or a custom generator returns null for the authorization-code token context.

Common situations: Overriding the authorizationCodeGenerator bean with a partial implementation; the default generator's SecureRandom/UUID source unavailable; builder wiring mistake when customizing authorization server settings.

Related errors

• SERVER_ERROR
• SERVER_ERROR
• SERVER_ERROR
• server_error
• invalid_request

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b934618c8bbbe050. Report an issue: GitHub.