diff --git a/authentik/providers/oauth2/views/authorize.py b/authentik/providers/oauth2/views/authorize.py index 6cfd5c8cf..3ae738d75 100644 --- a/authentik/providers/oauth2/views/authorize.py +++ b/authentik/providers/oauth2/views/authorize.py @@ -386,6 +386,9 @@ class AuthorizationFlowInitView(PolicyAccessView): def pre_permission_check(self): """Check prompt parameter before checking permission/authentication, see https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.6""" + # Quick sanity check at the beginning to prevent event spamming + if len(self.request.GET) < 1: + raise Http404 try: self.params = OAuthAuthorizationParams.from_request(self.request) except AuthorizeError as error: