{"record":{"id":"5cf93bb98e0bf49e","repo":"justauth/JustAuth","slug":"5006-5cf93b","errorCode":"5006","errorMessage":"Illegal redirect uri","messagePattern":"Illegal redirect uri","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthMicrosoftCnRequest.java","lineNumber":32,"sourceCode":" * @since 1.16.4\n */\npublic class AuthMicrosoftCnRequest extends AbstractAuthMicrosoftRequest {\n\n    public AuthMicrosoftCnRequest(AuthConfig config) {\n        super(config, AuthDefaultSource.MICROSOFT_CN);\n    }\n\n    public AuthMicrosoftCnRequest(AuthConfig config, AuthStateCache authStateCache) {\n        super(config, AuthDefaultSource.MICROSOFT_CN, authStateCache);\n    }\n\n    @Override\n    protected void checkConfig(AuthConfig config) {\n        super.checkConfig(config);\n        // 微软中国的回调地址必须为https的链接或者localhost,不允许使用http\n        if (AuthDefaultSource.MICROSOFT_CN == source && !GlobalAuthUtils.isHttpsProtocolOrLocalHost(config.getRedirectUri())) {\n            // Microsoft's redirect uri must use the HTTPS or localhost\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);\n        }\n    }\n\n}\n","sourceCodeStart":14,"sourceCodeEnd":37,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthMicrosoftCnRequest.java#L14-L37","documentation":"AuthMicrosoftCnRequest.checkConfig throws AuthException with code 5006 (ILLEGAL_REDIRECT_URI, msg 'Illegal redirect uri') when the configured redirectUri for the Microsoft (China / 21Vianet) source is not HTTPS and not localhost. Azure China requires HTTPS回调 addresses.","triggerScenarios":"Instantiating AuthMicrosoftCnRequest (any constructor) with a redirectUri starting with http:// that is not http://localhost... — the check runs before any network call.","commonSituations":"Local development over http://192.168.x.x or a LAN hostname, deploying behind a proxy that terminates TLS but config left as http, or copy-pasting the international-Azure (non-CN) redirect into the CN app.","solutions":["Change redirectUri to https://your-domain/callback","For local testing use http://localhost:<port>/callback (localhost is explicitly allowed)","If testing on another machine, map a hosts entry to localhost or use a self-signed-cert HTTPS proxy","Ensure the same HTTPS URL is registered as a redirect URI in the Azure CN app registration"],"exampleFix":"// before\nAuthConfig cfg = AuthConfig.builder()\n    .clientId(id).clientSecret(secret)\n    .redirectUri(\"http://192.168.1.5:8080/callback\")\n    .build();\n\n// after\nAuthConfig cfg = AuthConfig.builder()\n    .clientId(id).clientSecret(secret)\n    .redirectUri(\"http://localhost:8080/callback\") // or https://... in prod\n    .build();","handlingStrategy":"validation","validationCode":"String uri = config.getRedirectUri();\nboolean ok = uri != null && (uri.startsWith(\"https://\") || uri.startsWith(\"http://localhost\") || uri.startsWith(\"http://127.0.0.1\"));\nif (!ok) throw new IllegalArgumentException(\"Redirect URI must be https or localhost for Microsoft CN\");","typeGuard":"null","tryCatchPattern":"try {\n    new AuthMicrosoftCnRequest(config, stateCache);\n} catch (AuthException e) {\n    if (e.getCode() == 5006) { /* fix redirectUri to https/localhost */ }\n}","preventionTips":["Enforce https redirect URIs in all environments except localhost dev","Externalize redirectUri per environment (profile-based config)","Register the exact https callback in the Azure CN app registration"],"tags":["oauth","microsoft-cn","redirect-uri","https","config-validation"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}