server_
Registry Context
`server_error` indicates that an authorization server encountered an unexpected condition that prevented it from fulfilling an authorization request.
Technical Summary
RFC 6749 defines `server_error` for authorization code grant and implicit grant redirect-based error responses. It exists because an HTTP 500 status code cannot be returned to the client through an HTTP redirect.
When Used
Authorization code grant and implicit grant error responses returned through a valid client redirection URI.
Normative Requirements
Authorization servers
RFC 6749 - Section 4.1.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter value..
Condition: When returning an authorization code grant error response.
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 4.1.2.1
automatically redirect the user-agent to the invalid redirection URI..
Condition: If the authorization request has a missing, invalid, or mismatching redirection URI, or a missing or invalid client identifier.
the authorization server ... MUST NOT automatically redirect the user-agent to the invalid redirection URI.
RFC 6749 - Section 4.2.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter value..
Condition: When returning an implicit grant error response.
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 4.2.2.1
automatically redirect the user-agent to the invalid redirection URI..
Condition: If the implicit grant authorization request has a missing, invalid, or mismatching redirection URI, or a missing or invalid client identifier.
the authorization server ... MUST NOT automatically redirect the user-agent to the invalid redirection URI.
RFC 6749 - Section 4.1.2.1
include an `error` parameter containing a single ASCII error code, which may be `server_error`..
Condition: When returning an authorization code grant error response through the query component of the redirection URI.
error REQUIRED. A single ASCII [USASCII] error code from the following: ... server_error
RFC 6749 - Section 4.1.2.1
include the `state` parameter with the exact value received from the client..
Condition: When the authorization code grant authorization request included a `state` parameter.
state REQUIRED if a "state" parameter was present in the client authorization request. The exact value received from the client.
RFC 6749 - Section 4.2.2.1
include an `error` parameter containing a single ASCII error code, which may be `server_error`..
Condition: When returning an implicit grant error response through the fragment component of the redirection URI.
error REQUIRED. A single ASCII [USASCII] error code from the following: ... server_error
RFC 6749 - Section 4.2.2.1
include the `state` parameter with the exact value received from the client..
Condition: When the implicit grant authorization request included a `state` parameter.
state REQUIRED if a "state" parameter was present in the client authorization request. The exact value received from the client.
RFC 6749 - Section 4.1.2.1
inform the resource owner of the error..
Condition: If the authorization request has a missing, invalid, or mismatching redirection URI, or a missing or invalid client identifier.
the authorization server SHOULD inform the resource owner of the error
RFC 6749 - Section 4.2.2.1
inform the resource owner of the error..
Condition: If the implicit grant authorization request has a missing, invalid, or mismatching redirection URI, or a missing or invalid client identifier.
the authorization server SHOULD inform the resource owner of the error
Unspecified actor
RFC 6749 - Section 11.4.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in an error name submitted for registration..
Condition: When registering an error name in the OAuth Extensions Error Registry.
Values for the error name MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
Validation Guidance
For an authorization code grant redirect error containing `server_error`, require the `error` parameter in the query component and validate its permitted ASCII character set.
For an implicit grant redirect error containing `server_error`, require the `error` parameter in the fragment component and validate its permitted ASCII character set.
If the authorization request contained `state`, verify that the error response contains the exact same value.
Do not redirect a `server_error` response when the redirection URI is missing, invalid, or mismatching, or when the client identifier is missing or invalid.
Validate an OAuth Extensions Error Registry error name against `%x20-21 / %x23-5B / %x5D-7E`; this check does not require every registry entry to equal `server_error`.
Security Notes
RFC 9700 - Section 2.1.2
The implicit grant and other response types that issue access tokens in authorization responses are vulnerable to token leakage and replay. Clients SHOULD NOT use them unless access-token injection is prevented and the identified leakage vectors are mitigated.
Reference
Details
- Entry Id
server_error - Name
server_error - Usage Location
authorization endpoint- Protocol Extension
OAuth 2.0 Authorization Framework- Change Controller
IETF- Reference
RFC6749