What causes "Unable to inflate string" in spring-projects/spring-security?

Let Spring's resolver do the decoding: pass the raw HttpServletRequest parameter through instead of pre-decoding the b64 value.

spring-projects/spring-security · error · Saml2Exception

Unable to inflate string

Error message

Unable to inflate string

What it means

Same decompression logic as Saml2Utils.samlInflate in the service/web package, but this class lives in the authentication package: it raw-DEFLATE inflates SAML redirect-binding payloads, wrapping any IOException (invalid, truncated, or non-compressed input) in Saml2Exception 'Unable to inflate string'.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java:74

			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);
	}

	static DecodingConfigurer withEncoded(String encoded) {
		return new DecodingConfigurer(encoded);
	}

	static final class EncodingConfigurer {

		private final String decoded;

		private boolean deflate;

		private EncodingConfigurer(String decoded) {

View on GitHub (pinned to 96852e8860)

Solutions

Let Spring's resolver do the decoding: pass the raw HttpServletRequest parameter through instead of pre-decoding the b64 value.
Detect plain-XML payloads and skip inflation (check for '<' or a saml namespace in the decoded string).
Verify the IdP's redirect-binding compression settings (AuthnRequestsSigned / compress settings) match the SP expectation.
Log payload length and catch Saml2Exception to return HTTP 400 for malformed redirect requests.

Example fix

// before
String xml = Saml2Utils.samlInflate(Base64.getDecoder().decode(request.getParameter("SAMLRequest")));
// after
String decodedStr = new String(Base64.getDecoder().decode(request.getParameter("SAMLRequest")), StandardCharsets.UTF_8);
String xml = decodedStr.startsWith("<") ? decodedStr : Saml2Utils.samlInflate(request.getParameter("SAMLRequest")).getBytes(); // or use resolver API

Defensive patterns

Strategy: try-catch

Validate before calling

String decoded = new String(Base64.getDecoder().decode(param), StandardCharsets.UTF_8);
if (decoded.contains("<")) { /* plain XML, skip inflation */ }

Try / catch

try {
    String xml = Saml2Utils.samlInflate(bytes);
} catch (Saml2Exception ex) {
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
}

Prevention

Use Saml2RedirectAuthenticationRequestResolver instead of manual decode+inflate
Ensure single URL-decode and single base64-decode across the request path
Check IdP compression configuration matches SP expectations
Guard against truncated payloads caused by proxy URL-length limits

When it happens

Trigger: Processing a redirect-binding SAMLRequest/SAMLResponse (e.g. via Saml2RedirectAuthenticationRequestResolver) whose bytes, after single URL-decode and base64-decode, are not valid raw DEFLATE data.

Common situations: IdP sends uncompressed redirect-binding messages while the SP inflates; double URL/base64 decoding somewhere in a proxy chain; manually decoding the parameter before handing it to the resolver so it gets decoded twice; truncated query strings caused by proxies or intermediaries.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/e8123ddc1544f3b9. Report an issue: GitHub.