unauthorized_
Registry Context
OAuth error code indicating that a client is not authorized to use the requested authorization method or grant type.
Technical Summary
RFC 6749 defines `unauthorized_client` for authorization-code responses, implicit-grant responses, and token endpoint error responses. At the token endpoint, it means the authenticated client is not authorized to use the requested authorization grant type.
When Used
Authorization endpoint errors involving an unauthorized authorization-code or implicit method, and token endpoint errors involving an authenticated client that is unauthorized to use the requested grant type.
Normative Requirements
Clients
RFC 9700 - Section 2.1.2
use the implicit grant or another response type that issues access tokens in the authorization response.
Condition: unless access-token injection is prevented and the identified token-leakage vectors are mitigated
clients SHOULD NOT use the implicit grant (response type token) or other response types issuing access tokens in the authorization response
RFC 9700 - Section 2.1.2
use the `code` response type or another response type that causes access tokens to be issued in the token response.
Clients SHOULD instead use the response type code
Authorization servers
RFC 6749 - Section 4.1.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter.
Condition: when returning an authorization-code error response
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 4.1.2.1
automatically redirect the user-agent to the invalid redirection URI.
Condition: when the request fails because of a missing, invalid, or mismatching redirection URI, or a missing or invalid client identifier
the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
RFC 6749 - Section 4.2.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter.
Condition: when returning an implicit-grant error response
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 4.2.2.1
automatically redirect the user-agent to the invalid redirection URI.
Condition: when the request fails because of a missing, invalid, or mismatching redirection URI, or a missing or invalid client identifier
the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
RFC 6749 - Section 5.2
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter.
Condition: when returning a token endpoint error response
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 4.1.2.1
include an `error` parameter containing a single ASCII error code from the listed values, which include `unauthorized_client`.
Condition: when returning an authorization-code error response through the client's redirection URI
error REQUIRED. A single ASCII [USASCII] error code from the following:
RFC 6749 - Section 4.1.2.1
return the exact `state` value received from the client.
Condition: when an authorization-code error response is returned and the authorization request contained a `state` parameter
state REQUIRED if a "state" parameter was present in the client authorization request. The exact value received from the client.
RFC 6749 - Section 4.2.2.1
include an `error` parameter containing a single ASCII error code from the listed values, which include `unauthorized_client`.
Condition: when returning an implicit-grant error response through the client's redirection URI
error REQUIRED. A single ASCII [USASCII] error code from the following:
RFC 6749 - Section 4.2.2.1
return the exact `state` value received from the client.
Condition: when an implicit-grant error response is returned and the authorization request contained a `state` parameter
state REQUIRED if a "state" parameter was present in the client authorization request. The exact value received from the client.
RFC 6749 - Section 5.2
include an `error` parameter containing a single ASCII error code from the listed values, which include `unauthorized_client`.
Condition: when returning a token endpoint error response
error REQUIRED. A single ASCII [USASCII] error code from the following:
Validation Guidance
Interpret `unauthorized_client` in an authorization-code error response as indicating that the client is not authorized to request an authorization code using that method.
Interpret `unauthorized_client` in an implicit-grant error response as indicating that the client is not authorized to request an access token using that method.
Interpret `unauthorized_client` in a token endpoint error response as indicating that the authenticated client is not authorized to use the requested authorization grant type.
Require the `error` parameter in authorization-code, implicit-grant, and token endpoint error responses to contain a single listed ASCII error code.
Reject `error` values containing characters outside `%x20-21 / %x23-5B / %x5D-7E`.
When an authorization request included `state`, require the corresponding authorization-code or implicit-grant error response to return its exact value.
Do not automatically redirect the user-agent when the redirection URI is missing, invalid, or mismatching, or when the client identifier is missing or invalid.
Flag use of the implicit grant unless access-token injection and the identified token-leakage risks are mitigated.
Security Notes
RFC 9700 - Section 2.1.2
The OAuth 2.0 Security Best Current Practice advises clients against using the implicit grant unless access-token injection is prevented and token-leakage vectors are mitigated; clients should instead use a response type that returns access tokens from the token endpoint.
Reference
Details
- Entry Id
unauthorized_client - Name
unauthorized_client - Usage Location
authorization endpoint, token endpoint- Protocol Extension
OAuth 2.0 Authorization Framework- Change Controller
IETF- Reference
RFC6749