{"record":{"id":"5b392a8f527dfd81","repo":"dromara/Sa-Token","slug":"30125-5b392a","errorCode":"30125","errorMessage":"无效 response_type: ","messagePattern":"无效 response_type: ","errorType":"exception","errorClass":"SaOAuth2Exception","httpStatus":null,"severity":"error","filePath":"sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java","lineNumber":167,"sourceCode":"\t\t}\n\n\t\t// 8、判断授权类型，重定向到不同地址\n\t\t// \t\t如果是 授权码式，则：开始重定向授权，下放code\n\t\tif(ResponseType.code.equals(ra.responseType)) {\n\t\t\tCodeModel codeModel = dataGenerate.generateCode(ra);\n\t\t\tString redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);\n\t\t\treturn res.redirect(redirectUri);\n\t\t}\n\t\t\n\t\t// \t\t如果是 隐藏式，则：开始重定向授权，下放 token\n\t\tif(ResponseType.token.equals(ra.responseType)) {\n\t\t\tAccessTokenModel at = dataGenerate.generateAccessToken(ra, false, null);\n\t\t\tString redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);\n\t\t\treturn res.redirect(redirectUri);\n\t\t}\n\n\t\t// 默认返回\n\t\tthrow new SaOAuth2Exception(\"无效 response_type: \" + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);\n\t}\n\n\t/**\n\t * Code 换 Access-Token / 模式三：密码式 / 自定义 grant_type\n\t * @return 处理结果\n\t */\n\tpublic Object token() {\n\t\tAccessTokenModel accessTokenModel = SaOAuth2Strategy.instance.grantTypeAuth.apply(SaHolder.getRequest());\n\t\treturn SaOAuth2Manager.getDataResolver().buildAccessTokenReturnValue(accessTokenModel);\n\t}\n\n\t/**\n\t * Refresh-Token 刷新 Access-Token\n\t * @return 处理结果\n\t */\n\tpublic Object refresh() {\n\t\tSaRequest req = SaHolder.getRequest();\n","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java#L149-L185","documentation":"Thrown by SaOAuth2ServerProcessor.authorize when response_type is neither 'code' nor 'token'. sa-token's authorize endpoint only supports the authorization-code and implicit flows; any other value falls through to this rejection. Error code 30125.","triggerScenarios":"GET/POST /oauth2/authorize with response_type missing (empty string), or set to unsupported values like 'code token', 'id_token', or 'device_code'.","commonSituations":"Developer expects OIDC hybrid flow or PKCE-style response types that sa-token does not implement; typo such as response_type=codes; frontend reads an undefined JS variable so the param is sent empty.","solutions":["Use response_type=code for authorization-code flow or response_type=token for implicit flow","Check for typos and URL-encoding issues in the response_type parameter","If you need another flow (e.g. client_credentials or password), call /oauth2/token with the right grant_type instead of /oauth2/authorize"],"exampleFix":"// before\n/oauth2/authorize?client_id=1001&response_type=code%20token&...\n\n// after\n/oauth2/authorize?client_id=1001&response_type=code&redirect_uri=...&scope=getuserinfo","handlingStrategy":"validation","validationCode":"Set<String> supported = new HashSet<>(Arrays.asList(\"code\", \"token\"));\nif(!supported.contains(responseType)) {\n    throw new IllegalArgumentException(\"response_type must be code or token\");\n}","typeGuard":null,"tryCatchPattern":"catch(SaOAuth2Exception e) { if(\"30125\".equals(e.getCode())) return badRequest(\"unsupported response_type: \" + e.getMessage()); }","preventionTips":["Hardcode response_type=code unless implicit flow is explicitly needed","Add a client-side enum for response types to prevent typos"],"tags":["oauth2","response-type","authorize","sa-token"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}