Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

invalid_request_uri

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The request_uri is unknown, expired, already used, pushed by another client, or not a fetchable registered URL (RFC 9126 §2.2, RFC 9101 §5.2, §6.2).

Meaning

At /authorize, a request_uri is redeemed against the pushed requests /par stored. One that is unknown, expired, spent or pushed by another client is a direct refusal, so on the wire it is invalid_request. Any other request_uri names a request object by reference: it must be one of the client's registered request_uris (compared without the fragment), and is refused when it is not, when the object cannot be fetched (the host is not a global address, the fetch fails or times out, the status is not 200, the body is too large), or when the deployment fetches none. A request that carries both request and request_uri is refused directly too. The code itself is redirected to the client when a reference that validated was used up by a concurrent authorization, or expired, before the code could be issued.

Impact

The user is not signed in to the application. A reference outlives a normal sign-in, but a user who leaves the screen open past its lifetime, or a browser that replays the same /authorize URL, will meet it. The application has to push a new request.

Diagnosis

  1. The audit record under oauth.authorization.requested has reason invalid_request_uri or request_uri_client_mismatch, and a cause such as request_uri_not_registered, request_uri_fetch_failed, request_uri_not_pushed, request_and_request_uri or request_uri_consumed.
  2. A request_uri_client_mismatch names the client that pushed the request: someone presented another client's reference.

Mitigation

  • As a client developer: push a fresh request for every sign-in and use its request_uri once, with the same client_id. To pass an object by reference, register its URL in request_uris and serve it over https from a public address.
  • As an operator: a run of request_uri_client_mismatch is a replay attempt; check the client and address it came from.
  • As a user: start the sign-in again from the application.

Escalation

If a fresh reference is refused at once, check Redis reachability from every replica, then open an issue with the request id and the server version. Never attach the request_uri.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.