Respond with 400 status code and invalid_request for malformed content types where specifications require it - #51410

tests/base/src/test/java/org/keycloak/tests/oauth/MalformedContentTypeTest.java:93

• This uses a refresh token where the endpoint requires an OIDC logout token. If the malformed header is accidentally accepted, logout-token validation still returns the same 400 invalid_request, so this test can pass without exercising the behavior under test; use a valid logout token or otherwise distinguish the content-type error from token-validation errors.

        BackchannelLogoutResponse response = oauth.backchannelLogoutRequest(tokenResponse.getRefreshToken())

services/src/main/java/org/keycloak/protocol/oidc/utils/ContentTypeValidationUtil.java:25

• This hard-coded ErrorResponseException drops CORS headers. PAR, token revocation, and legacy logout use CorsErrorResponseException for normal failures, but they invoke this helper before their CORS-aware error handling, so browsers cannot read the new malformed-header response; let CORS-enabled callers build a CORS-aware invalid_request response.

        } catch (IllegalArgumentException e) {
            throw new ErrorResponseException(Errors.INVALID_REQUEST, "The content-type header value did not correspond to a valid media type", Response.Status.BAD_REQUEST);
        }
        if (!requestMediaType.isCompatible(requiredMediaType)) {
            throw new ErrorResponseException(Errors.INVALID_REQUEST, "The content-type header value does not match consumed media type " + requiredMediaType, Response.Status.BAD_REQUEST);

tests/base/src/test/java/org/keycloak/tests/oauth/MalformedContentTypeTest.java:129

• This added test does not exercise the incompatible-media branch in ContentTypeValidationUtil: DeviceEndpoint never calls that utility, and its new exception mapper handles the @Consumes rejection before endpoint dispatch. Add a direct utility test (or remove the unreachable branch) rather than treating this as coverage for lines 24–25.

                .header("Content-Type", MediaType.TEXT_HTML)
                .send();
        assertOAuthInvalidRequest(response);

services/src/main/java/org/keycloak/protocol/oidc/utils/ContentTypeValidationUtil.java:26

• MediaType.isCompatible treats wildcard values such as */* and application/* as compatible, so these unsupported Content-Type values bypass the new validation even though the endpoints require form encoding. Reject wildcard media types before applying compatibility.

        if (!requestMediaType.isCompatible(requiredMediaType)) {
            throw new ErrorResponseException(Errors.INVALID_REQUEST, "The content-type header value does not match consumed media type " + requiredMediaType, Response.Status.BAD_REQUEST);

services/src/main/java/org/keycloak/protocol/oidc/utils/ContentTypeValidationUtil.java:25

• @Consumes(APPLICATION_FORM_URLENCODED) rejects a valid incompatible type during resource matching, before these endpoint methods call this utility, so this branch cannot turn text/html into 400 invalid_request for PAR, CIBA, revocation, or logout. The added incompatible-type test exercises only DeviceEndpoint's separate exception mapper; handle NotSupportedException at each applicable resource boundary and cover a utility-backed endpoint as well.

        if (!requestMediaType.isCompatible(requiredMediaType)) {
            throw new ErrorResponseException(Errors.INVALID_REQUEST, "The content-type header value does not match consumed media type " + requiredMediaType, Response.Status.BAD_REQUEST);

tests/base/src/test/java/org/keycloak/tests/oauth/MalformedContentTypeTest.java:123

• This test exercises DeviceEndpoint's separate NotSupportedException mapper, not the compatibility branch in ContentTypeValidationUtil; every utility call site is still tested only with values that fail during parsing. Add a valid incompatible case against PAR, CIBA, logout, or revocation, or remove that branch if it is not intended to be reachable.

    void deviceAuthorizationEndpointIncompatibleType() {