{"record":{"id":"2cb03e36ae9f6456","repo":"justauth/JustAuth","slug":"5006-2cb03e","errorCode":"5006","errorMessage":"Illegal redirect uri","messagePattern":"Illegal redirect uri","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthMicrosoftRequest.java","lineNumber":33,"sourceCode":" * @since 1.5.0\n */\npublic class AuthMicrosoftRequest extends AbstractAuthMicrosoftRequest {\n\n    public AuthMicrosoftRequest(AuthConfig config) {\n        super(config, AuthDefaultSource.MICROSOFT);\n    }\n\n    public AuthMicrosoftRequest(AuthConfig config, AuthStateCache authStateCache) {\n        super(config, AuthDefaultSource.MICROSOFT, authStateCache);\n    }\n\n    @Override\n    protected void checkConfig(AuthConfig config) {\n        super.checkConfig(config);\n        // 微软的回调地址必须为https的链接或者localhost,不允许使用http\n        if (AuthDefaultSource.MICROSOFT == source && !GlobalAuthUtils.isHttpsProtocolOrLocalHost(config.getRedirectUri())) {\n            // Microsoft's redirect uri must use the HTTPS or localhost\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);\n        }\n    }\n\n}\n","sourceCodeStart":15,"sourceCodeEnd":38,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthMicrosoftRequest.java#L15-L38","documentation":"Same guard as the CN variant but for AuthDefaultSource.MICROSOFT (global Azure): checkConfig throws AuthException code 5006 'Illegal redirect uri' when redirectUri is not HTTPS and not localhost. Azure AD enforces HTTPS for redirect URIs (localhost exempted for dev).","triggerScenarios":"Constructing AuthMicrosoftRequest with an http:// redirectUri other than localhost; thrown immediately from the constructor, before any HTTP traffic.","commonSituations":"Dev servers exposed on LAN IPs, staging environments without TLS, proxy setups where the external URL is https but config keeps the internal http one.","solutions":["Use an https:// redirectUri matching the app registration in Azure Portal","Use http://localhost:port for local development","If behind a reverse proxy, configure the public https URL in AuthConfig (not the internal hop)","Register the exact URI (path and query-less) in Azure AD's Authentication blade"],"exampleFix":"// before\n.redirectUri(\"http://myapp.example.com/callback\")\n\n// after\n.redirectUri(\"https://myapp.example.com/callback\")","handlingStrategy":"validation","validationCode":"String uri = config.getRedirectUri();\nif (uri == null || !(uri.startsWith(\"https://\") || uri.startsWith(\"http://localhost\"))) {\n    throw new IllegalArgumentException(\"Microsoft redirectUri must be https or localhost\");\n}","typeGuard":"null","tryCatchPattern":"try {\n    new AuthMicrosoftRequest(config, stateCache);\n} catch (AuthException e) {\n    if (e.getCode() == 5006) { config = config.toBuilder().redirectUri(\"https://...\").build(); }\n}","preventionTips":["Default to https in templates; allow http only for localhost in dev profiles","Behind TLS-terminating proxies, configure the public https URL, not the internal hop","Keep Azure app registration redirect URIs in sync with deployed config"],"tags":["oauth","microsoft","azure-ad","redirect-uri","https"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}