OAuth2AuthorizationCodeRequestAuthenticationValidator.validateRedirectUri throws OAuth2AuthorizationCodeRequestAuthenticationToken when an invalid redirect_uri is used during the authorization request.

Additionally, OAuth2AuthorizationCodeRequestAuthenticationValidator.validateScope throws the same when an invalid scope is used.

We should consider adding a log entry at DEBUG level in OAuth2AuthorizationCodeRequestAuthenticationValidator for each of these cases. This would allow the logging level to be tuned specifically for this logging. If a user customizes the authentication validators e.g. to add custom redirect uri validation, they would be responsible for their own logging.