{"record":{"id":"4d48ef487c2a42d9","repo":"justauth/JustAuth","slug":"5008","errorCode":"5008","errorMessage":"Illegal code","messagePattern":"Illegal code","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthAlipayCertRequest.java","lineNumber":47,"sourceCode":" * @since 1.16.7\n */\npublic class AuthAlipayCertRequest extends AuthDefaultRequest {\n\n    private final AlipayClient alipayClient;\n\n    public AuthAlipayCertRequest(AuthConfig config, AlipayConfig alipayConfig) {\n        super(config, ALIPAY);\n        try {\n            this.alipayClient = new DefaultAlipayClient(alipayConfig);\n        } catch (AlipayApiException e) {\n            throw new AuthException(e);\n        }\n    }\n\n    @Override\n    protected void checkCode(AuthCallback authCallback) {\n        if (StringUtils.isEmpty(authCallback.getAuth_code())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);\n        }\n    }\n\n    @Override\n    public AuthToken getAccessToken(AuthCallback authCallback) {\n        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();\n        request.setGrantType(\"authorization_code\");\n        request.setCode(authCallback.getAuth_code());\n        AlipaySystemOauthTokenResponse response;\n        try {\n            response = this.alipayClient.certificateExecute(request);\n        } catch (Exception e) {\n            throw new AuthException(e);\n        }\n        if (!response.isSuccess()) {\n            throw new AuthException(response.getSubMsg());\n        }\n        return AuthToken.builder()","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthAlipayCertRequest.java#L29-L65","documentation":"AuthAlipayCertRequest.checkCode throws AuthException 5008 (Illegal code) when the callback carries no auth_code. Alipay's OAuth callback parameter is named auth_code (not code like most providers); if it is absent — wrong callback parsing, using the generic code field, or a manually constructed callback — the library rejects it before calling Alipay.","triggerScenarios":"Building AuthCallback from a request where only 'code' was copied; Alipay redirecting with an error/empty auth_code (user denied or app misconfigured is_au=true scope); a callback mapping that drops query parameters.","commonSituations":"Generic callback controllers that read request.getParameter(\"code\") for all providers and never populate auth_code for Alipay; URL-encoding or routing rules stripping query params; testing callbacks by hand without the auth_code parameter.","solutions":["In the Alipay callback handler, populate AuthCallback.auth_code from the auth_code request parameter (AuthCallback.builder().auth_code(request.getParameter(\"auth_code\")) ...).","If your controller uses a generic mapper, special-case Alipay: also copy auth_code in addition to code.","Log raw query strings on OAuth callbacks so missing parameters are visible immediately."],"exampleFix":"// before\nAuthCallback cb = AuthCallback.builder().code(request.getParameter(\"code\")).build(); // auth_code null -> 5008\n\n// after\nAuthCallback cb = AuthCallback.builder()\n    .auth_code(request.getParameter(\"auth_code\")) // Alipay sends auth_code\n    .build();","handlingStrategy":"validation","validationCode":"String authCode = request.getParameter(\"auth_code\");\nif (StringUtils.isEmpty(authCode)) { throw new IllegalArgumentException(\"Alipay callback missing auth_code\"); }\nAuthCallback cb = AuthCallback.builder().auth_code(authCode).build();","typeGuard":null,"tryCatchPattern":"try { return request.login(cb); } catch (AuthException e) { if (e.getErrcode() == AuthResponseStatus.ILLEGAL_CODE.getCode()) { return respond(\"missing auth_code, restart Alipay authorization\"); } throw e; }","preventionTips":["Special-case Alipay in the callback controller: read auth_code, not code.","Log raw query strings on OAuth callback endpoints.","Cover each provider's callback parameter names in integration tests."],"tags":["justauth","alipay","callback-parsing","illegal-code","oauth2"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}