spring-projects/spring-security · error · Saml2Exception

Unable to inflate string

Error message

Unable to inflate string

What it means

Saml2Utils.samlInflate decompresses a DEFLATE-compressed (raw, no zlib header) SAML payload, typically the redirect-binding SAMLRequest/SAMLResponse. Any IOException from the InflaterOutputStream — corrupt or truncated compressed bytes — is wrapped in this Saml2Exception.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2Utils.java:74

			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);
	}

	static DecodingConfigurer withEncoded(String encoded) {
		return new DecodingConfigurer(encoded);
	}

	static final class EncodingConfigurer {

		private final String decoded;

		private boolean deflate;

		private EncodingConfigurer(String decoded) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify the input is URL-decoded exactly once and then Base64-decoded exactly once before inflation (use Saml2Utils.withDecoded(...).inflate() pipeline rather than manual steps).
2. Check whether the IdP actually applies DEFLATE compression on redirect bindings; if it does not, skip inflation and parse the decoded XML directly.
3. Log the byte length and first bytes of the payload; truncated input (payload cut by proxies) must be fixed at the proxy/max-URL-length level.
4. Catch Saml2Exception around redirect-binding processing and return a 400 with guidance instead of a 500.

Example fix

// before
byte[] decoded = Base64.getDecoder().decode(b64);
String xml = Saml2Utils.samlInflate(decoded); // fails when payload is plain XML
// after
String decoded = new String(Base64.getDecoder().decode(b64), StandardCharsets.UTF_8);
String xml = decoded.contains("<saml2p:") || decoded.contains("<samlp:") ? decoded : Saml2Utils.samlInflate(Base64.getDecoder().decode(b64));

String decoded = new String(Base64.getDecoder().decode(b64), StandardCharsets.UTF_8);
if (decoded.contains("<saml") || decoded.contains("<samlp")) return decoded; // already plain XML

try {
    String xml = Saml2Utils.samlInflate(bytes);
} catch (Saml2Exception ex) {
    logger.warn("Bad SAML redirect payload", ex);
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
}

When it happens

Trigger: Calling samlInflate (directly or via Saml2RedirectAuthenticationRequestResolver flows that decode+inflate) with bytes that are not valid raw-DEFLATE data: wrong URL-decoding, double-decoding, decoding base64 that isn't DEFLATE-compressed, or truncated parameters.

Common situations: The IdP signs/sends uncompressed SAMLRequest while the SP expects DEFLATE; the b64 value was already decoded once (e.g. by a proxy or prior Base64.decode) and then decoded/inflated again; query-string characters (+, %) mangled by manual URL decoding; relay/SAML parameter truncated by a proxy with a URL length limit.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Unable to inflate string
• Unable to inflate string
• An error occurred while attempting to decode the Jwt: + ex.g
• internal_validation_error
• malformed_response_data

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d0782c0511081451. Report an issue: GitHub.