What causes "Unable to inflate string" in spring-projects/spring-security?

Confirm the input is base64-decoded first (Saml2Utils.samlDecode) before inflating — inflate is never the first step.

spring-projects/spring-security · error · Saml2Exception

Unable to inflate string

Error message

Unable to inflate string

What it means

Saml2Utils.samlInflate decompresses a raw (nowrap) DEFLATE byte stream used by SAML HTTP-Redirect binding; an IOException during inflation is wrapped in this Saml2Exception. It almost always means the input bytes are not a valid raw DEFLATE stream — a wrong decoding step was applied or the payload is corrupted.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java:76

			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(out, new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);
	}

	static DecodingConfigurer withEncoded(String encoded) {
		return new DecodingConfigurer(encoded);
	}

	static final class EncodingConfigurer {

		private final String decoded;

		private boolean deflate;

		private EncodingConfigurer(String decoded) {

View on GitHub (pinned to 96852e8860)

Solutions

Confirm the input is base64-decoded first (Saml2Utils.samlDecode) before inflating — inflate is never the first step.
Ensure raw DEFLATE (nowrap) is what the peer sent; a zlib header means the bytes are malformed for this method.
Log the first bytes of the input to verify it is binary compressed data, not base64 text or XML.
Catch the Saml2Exception and reject the request as invalid; do not retry unmodified input.

Example fix

// before
String xml = Saml2Utils.samlInflate(request.getParameter("SAMLRequest").getBytes());
// Saml2Exception: Unable to inflate string
// after
byte[] decoded = Saml2Utils.samlDecode(request.getParameter("SAMLRequest"));
String xml = Saml2Utils.samlInflate(decoded);

Defensive patterns

Strategy: validation

Validate before calling

byte[] decoded = Saml2Utils.samlDecode(param); // base64 first
if (decoded == null || decoded.length == 0) {
    throw new IllegalArgumentException("Empty SAML message after base64 decode");
}

Try / catch

try {
    String xml = Saml2Utils.samlInflate(decoded);
} catch (Saml2Exception ex) {
    throw new AuthenticationServiceException("SAML message is not valid DEFLATE data", ex);
}

Prevention

Always base64-decode before inflating — inflate is never the first step.
Expect raw DEFLATE (nowrap), not zlib-wrapped data.
Log first input bytes when diagnosing to spot plaintext/base64 passed by mistake.
Reject (do not retry) requests whose inflate fails — likely tampering or misconfiguration.

When it happens

Trigger: Calling Saml2Utils.samlInflate(byte[]) with bytes that are not raw-DEFLATE data: base64 decoding was skipped or wrong, the peer produced zlib-wrapped rather than raw deflate, or the bytes are plaintext XML passed in directly.

Common situations: Redirect-binding SAMLRequest/SAMLResponse handling where the caller inflated before base64-decoding; tampered or truncated query parameters; double-compressed payloads from a misconfigured IdP; using standard Base64 instead of URL-safe/Base64 without padding where required.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/0e716456d328f925. Report an issue: GitHub.