# invalid_request_uri

The request_uri is unknown, expired, already used, pushed by another client, or not a fetchable registered URL (RFC 9126 §2.2, RFC 9101 §5.2, §6.2).

## Meaning

At `/authorize`, a `request_uri` is redeemed against the pushed requests `/par` stored.
One that is unknown, expired, spent or pushed by another client is a direct refusal,
so on the wire it is `invalid_request`. Any other `request_uri` names a request object
by reference: it must be one of the client's registered `request_uris` (compared
without the fragment), and is refused when it is not, when the object cannot be
fetched (the host is not a global address, the fetch fails or times out, the status is
not 200, the body is too large), or when the deployment fetches none. A request that
carries both `request` and `request_uri` is refused directly too. The code itself is
redirected to the client when a reference that validated was used up by a concurrent
authorization, or expired, before the code could be issued.

## Impact

The user is not signed in to the application. A reference outlives a normal sign-in,
but a user who leaves the screen open past its lifetime, or a browser that replays the
same `/authorize` URL, will meet it. The application has to push a new request.

## Diagnosis

1. The audit record under `oauth.authorization.requested` has reason
   `invalid_request_uri` or `request_uri_client_mismatch`, and a cause such as
   `request_uri_not_registered`, `request_uri_fetch_failed`, `request_uri_not_pushed`,
   `request_and_request_uri` or `request_uri_consumed`.
2. A `request_uri_client_mismatch` names the client that pushed the request: someone
   presented another client's reference.

## Mitigation

- As a client developer: push a fresh request for every sign-in and use its
  `request_uri` once, with the same `client_id`. To pass an object by reference,
  register its URL in `request_uris` and serve it over https from a public address.
- As an operator: a run of `request_uri_client_mismatch` is a replay attempt; check the
  client and address it came from.
- As a user: start the sign-in again from the application.

## Escalation

If a fresh reference is refused at once, check Redis reachability from every replica,
then open an issue with the request id and the server version. Never attach the
`request_uri`.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.