调用OAuth2 Token接口报错：请求缺少必填参数

问题背景 #

我尝试用application/x-www-form-urlencoded格式调用REST API，参数如下：

private String tokenEndpoint = "https://xxxxxxxxxxxxx/oauth2/token";
private String client_id = "2xxxxxxxxxxxxxxxxx";
private String client_secret = "xxxxxxxxxxxxxxxxxxxx";
private String grant_type = "client_credentials";
private String scope = "projects:read";

调用后收到错误：

{"error":"invalid_request","error_description":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Client credentials missing or malformed in both HTTP Authorization header and HTTP POST body."}

我的实现代码如下：

package testRestAPI;

import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.security.cert.X509Certificate;
import java.util.Base64;
import javax.net.ssl.SSLContext;
import org.apache.commons.io.IOUtils;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.TrustStrategy;


public class OAuthClient {

    private String tokenEndpoint = "https://xxxxxxxxxxxxx/oauth2/token";
    private String client_id = "2xxxxxxxxxxxxxxxxx";
    private String client_secret = "xxxxxxxxxxxxxxxxxxxx";
    private String grant_type = "client_credentials";
    private String scope = "projects:read";
    

    public String callService()  {


        String result = null;

        try {

                        //My site is set as insecure, so I set the following setting
            TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;

            SSLContext sslContext = org.apache.http.ssl.SSLContexts.custom()
                    .loadTrustMaterial(null, acceptingTrustStrategy)
                    .build();

            SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);

            CloseableHttpClient httpClient = HttpClients.custom()
                    .setSSLSocketFactory(csf)
                    .build();


            /* HTTPCLIENT AND HTTPPOST OOBJECT */
            //      HttpClient httpClient = HttpClientBuilder.create().build();
            HttpPost httpPost = new HttpPost(tokenEndpoint);

            /* AUTHENTICATION CREDENTIALS ENCODING */
            String base64Credentials = Base64.getEncoder().encodeToString((client_id + ":" 
                    + client_secret).getBytes());

            /* HEADER INFO */
            httpPost.addHeader("Authorization","Bearer " +  base64Credentials);
            httpPost.addHeader("Content-Type", "application/x-www-form-urlencoded");

            //      /* PROXY CONFIG */
            //              HttpHost target = new HttpHost("proxy", 8080, "http");
            //              RequestConfig config = RequestConfig.custom().setProxy(target).build();
            //              httpPost.setConfig(config);

            /* OAUTH PARAMETERS ADDED TO BODY */
            StringEntity input = null;
            try {
                input = new StringEntity("grant_type=" + grant_type + "&scope=" + scope);
                httpPost.setEntity(input);
            } catch (UnsupportedEncodingException e) {
                e.printStackTrace();
            }

            /* SEND AND RETRIEVE RESPONSE */
            HttpResponse response = null;
            try {
                response = httpClient.execute(httpPost);
            } catch (IOException e) {
                e.printStackTrace();
            }

            /* RESPONSE AS STRING */
            //      String result = null;
            try {
                result = IOUtils.toString(response.getEntity().getContent(), "UTF-8");
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
        catch (Exception e) {
            // TODO: handle exception
        }
        return result;
    }

    public static void main(String[] args) {
        OAuthClient oauthClient = new OAuthClient();
        String res = oauthClient.callService();
        System.out.println(res);
    }
}

重复调用后仍收到相同错误，但用Postman可以成功连接，也查阅了OAuth提供商的API文档，现寻求该报错的解决方案。

解决方案 #

错误原因分析 #

1. Authorization头认证类型错误：Client Credentials模式下，客户端凭证认证需要用Basic前缀，而非Bearer（Bearer是携带访问令牌的前缀）。
2. 表单参数处理不规范：手动拼接StringEntity可能存在编码遗漏，导致请求格式不符合application/x-www-form-urlencoded的规范要求。

修改后的代码 #

package testRestAPI;

import java.io.IOException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;
import javax.net.ssl.SSLContext;
import org.apache.commons.io.IOUtils;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.entity.UrlEncodedFormEntity;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.ssl.TrustStrategy;

public class OAuthClient {

    private String tokenEndpoint = "https://xxxxxxxxxxxxx/oauth2/token";
    private String client_id = "2xxxxxxxxxxxxxxxxx";
    private String client_secret = "xxxxxxxxxxxxxxxxxxxx";
    private String grant_type = "client_credentials";
    private String scope = "projects:read";

    public String callService() {
        String result = null;
        try {
            // 信任所有证书（仅测试环境使用）
            TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;
            SSLContext sslContext = org.apache.http.ssl.SSLContexts.custom()
                    .loadTrustMaterial(null, acceptingTrustStrategy)
                    .build();
            SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);
            CloseableHttpClient httpClient = HttpClients.custom()
                    .setSSLSocketFactory(csf)
                    .build();

            HttpPost httpPost = new HttpPost(tokenEndpoint);

            // 修复Authorization头：使用Basic前缀
            String base64Credentials = java.util.Base64.getEncoder().encodeToString((client_id + ":" + client_secret).getBytes());
            httpPost.addHeader("Authorization", "Basic " + base64Credentials);
            httpPost.addHeader("Content-Type", "application/x-www-form-urlencoded");

            // 使用UrlEncodedFormEntity处理表单参数，自动处理编码
            List<NameValuePair> params = new ArrayList<>();
            params.add(new BasicNameValuePair("grant_type", grant_type));
            params.add(new BasicNameValuePair("scope", scope));
            httpPost.setEntity(new UrlEncodedFormEntity(params, "UTF-8"));

            // 发送请求并获取响应
            HttpResponse response = httpClient.execute(httpPost);
            result = IOUtils.toString(response.getEntity().getContent(), "UTF-8");

            // 释放资源
            httpClient.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return result;
    }

    public static void main(String[] args) {
        OAuthClient oauthClient = new OAuthClient();
        String res = oauthClient.callService();
        System.out.println(res);
    }
}

关键修改点 #

1. 修正Authorization头：将Bearer替换为Basic，符合OAuth2 Client Credentials模式的客户端凭证认证规范。
2. 优化参数处理：用UrlEncodedFormEntity替代手动拼接的StringEntity，自动完成参数的URL编码，保证请求格式合规。
3. 资源管理：添加httpClient.close()确保HTTP客户端资源正常释放。

内容的提问来源于stack exchange，提问作者ציפי גולדברג