{"record":{"id":"263074efa0593c84","repo":"justauth/JustAuth","slug":"5008-263074","errorCode":"5008","errorMessage":"Illegal code","messagePattern":"Illegal code","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java","lineNumber":145,"sourceCode":"\n    protected void check(AuthConfig config) {\n        AuthChecker.checkConfig(config, AuthDefaultSource.ALIPAY);\n\n        if (!StringUtils.isNotEmpty(alipayPublicKey)) {\n            throw new AuthException(AuthResponseStatus.PARAMETER_INCOMPLETE, AuthDefaultSource.ALIPAY);\n        }\n\n        // 支付宝在创建回调地址时，不允许使用localhost或者127.0.0.1\n        if (GlobalAuthUtils.isLocalHost(config.getRedirectUri())) {\n            // The redirect uri of alipay is forbidden to use localhost or 127.0.0.1\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, AuthDefaultSource.ALIPAY);\n        }\n    }\n\n    @Override\n    protected void checkCode(AuthCallback authCallback) {\n        if (StringUtils.isEmpty(authCallback.getAuth_code())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);\n        }\n    }\n\n    @Override\n    public AuthToken getAccessToken(AuthCallback authCallback) {\n        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();\n        request.setGrantType(\"authorization_code\");\n        request.setCode(authCallback.getAuth_code());\n        AlipaySystemOauthTokenResponse response;\n        try {\n            response = this.alipayClient.execute(request);\n        } catch (Exception e) {\n            throw new AuthException(e);\n        }\n        if (!response.isSuccess()) {\n            throw new AuthException(response.getSubMsg());\n        }\n        return AuthToken.builder()","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java#L127-L163","documentation":"AuthException with AuthResponseStatus.ILLEGAL_CODE (code 5008) thrown from AuthAlipayRequest.checkCode when authCallback.getAuth_code() is empty. Alipay returns the authorization code in a query/body parameter named auth_code (not the usual code), so JustAuth validates it explicitly before the token exchange.","triggerScenarios":"Calling login(authCallback) / getAccessToken(authCallback) where the callback from Alipay has no auth_code parameter — e.g. the user denied consent, Alipay redirected with an error, or the callback was parsed as a generic OAuth2 callback expecting code instead of auth_code.","commonSituations":"User clicked 'deny' on the Alipay consent page so Alipay redirects without auth_code; servlet mapping consumed the parameter; manually constructing AuthCallback for tests and setting code instead of auth_code.","solutions":["Inspect the raw callback query string — if auth_code is absent, check for Alipay error parameters (error, error_description) and surface those to the user","Make sure the redirect URI handling passes the full query string into AuthCallback","When testing, populate authCallback.auth_code (Alipay's parameter name), not code"],"exampleFix":"// before (test code)\nAuthCallback cb = new AuthCallback();\ncb.setCode(\"xyz\");\n\n// after\nAuthCallback cb = new AuthCallback();\ncb.setAuth_code(\"xyz\");","handlingStrategy":"validation","validationCode":"if (StringUtils.isEmpty(callback.getAuth_code())) {\n    String err = callback.getError(); // may explain why auth_code is absent\n    // user denied or flow failed — do not call login()\n    return redirectToAuthorize(ALIPAY).withFlash(\"auth_failed\", err);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check for Alipay's auth_code parameter name before invoking login","Handle denial/error redirects explicitly instead of proceeding to token exchange","Bind the full callback query string into AuthCallback"],"tags":["alipay","oauth","callback","validation"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}