Reject oversized request parameters at authorization endpoint with HTTP 414#322

Merged

oharsta merged 11 commits intomainfrom

copilot/check-parameter-size-issue

Feb 17, 2026

Commits on Feb 17, 2026

Initial plan
Copilot
committed
Add URI too long validation to authorization endpoint

Copilot
and
oharsta
committed
Add tests for URI too long validation

Copilot
and
oharsta
committed
Address code review feedback - make validation method package-private and remove reflection from tests

Copilot
and
oharsta
committed
Add JavaDoc documentation to validateQueryParamSize method

Copilot
and
oharsta
committed
Validate parameters MultiValueMap instead of query string to support both GET and POST requests

Copilot
and
oharsta
committed
Optimize parameter size calculation to avoid intermediate string allocation

Copilot
and
oharsta
committed
Use URL-encoded size for more accurate parameter size validation

Copilot
and
oharsta
committed
Calculate URL-encoded size incrementally to avoid heap issues with large parameters

Copilot
and
oharsta
committed
BSR
oharsta
committed
Fixed tests
oharsta
committed