{"record":{"id":"5d003fcecd3464b6","repo":"dromara/Sa-Token","slug":"30125","errorCode":"30125","errorMessage":"无效 response_type: ${responseType}","messagePattern":"无效 response_type: (.+?)","errorType":"http","errorClass":"SaOAuth2Exception","httpStatus":null,"severity":"error","filePath":"sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/h5/SaOAuth2ServerH5Controller.java","lineNumber":94,"sourceCode":"        }\n\n        // 8、判断授权类型，重定向到不同地址\n        // \t\t如果是 授权码式，则：开始重定向授权，下放code\n        if(SaOAuth2Consts.ResponseType.code.equals(ra.responseType)) {\n            CodeModel codeModel = dataGenerate.generateCode(ra);\n            String redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);\n            return SaResult.ok().set(\"redirect_uri\", redirectUri);\n        }\n\n        // \t\t如果是 隐藏式，则：开始重定向授权，下放 token\n        if(SaOAuth2Consts.ResponseType.token.equals(ra.responseType)) {\n            AccessTokenModel at = dataGenerate.generateAccessToken(ra, false, null);\n            String redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);\n            return SaResult.ok().set(\"redirect_uri\", redirectUri);\n        }\n\n        // 默认返回\n        throw new SaOAuth2Exception(\"无效 response_type: \" + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);\n    }\n\n}\n","sourceCodeStart":76,"sourceCodeEnd":98,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/h5/SaOAuth2ServerH5Controller.java#L76-L98","documentation":"SaOAuth2Exception (error code 30125) thrown by the demo OAuth2 server's H5 authorize controller when the response_type parameter is neither 'code' (authorization-code mode) nor 'token' (implicit mode). It marks the fall-through case after both supported response types have been checked, meaning the request asked for an unsupported or misspelled grant flow.","triggerScenarios":"GET /oauth2/authorize with response_type=password, response_type=client_token, or a typo like 'code ' (trailing space) or 'Token' (case-sensitive compare via SaOAuth2Consts.ResponseType). Any value not exactly 'code' or 'token' hits the default throw.","commonSituations":"Client configured for password-mode or client-credentials-mode authorization but pointed at the authorize endpoint (those flows use the token endpoint, not authorize); copy-pasting response_type from another OAuth2 provider's docs; trailing whitespace from a properties/yml value.","solutions":["Set response_type=code (authorization-code flow) or response_type=token (implicit flow) on the authorize request.","If you intended password or client_credentials mode, call the token endpoint (/oauth2/token) directly instead of the authorize endpoint.","Trim and lowercase the parameter before sending; comparison is exact String.equals against constants.","Check SaOAuth2ErrorCode.CODE_30125 documentation for the full list of valid response types in your sa-token version."],"exampleFix":"// before\nhttp://localhost:8001/oauth2/authorize?response_type=password&client_id=xxx&redirect_uri=xxx\n\n// after\nhttp://localhost:8001/oauth2/authorize?response_type=code&client_id=xxx&redirect_uri=xxx\n// (password-mode belongs on the token endpoint, not authorize)","handlingStrategy":"validation","validationCode":"String rt = ra.responseType == null ? \"\" : ra.responseType.trim();\nif (!(\"code\".equals(rt) || \"token\".equals(rt))) {\n    return SaResult.error(\"response_type must be code or token on the authorize endpoint\");\n}","typeGuard":"boolean isValidResponseType(String v) { return \"code\".equals(v) || \"token\".equals(v); }","tryCatchPattern":"try { ... } catch (SaOAuth2Exception e) { if (e.getCode() == SaOAuth2ErrorCode.CODE_30125) { /* surface to client as invalid_request */ } }","preventionTips":["Route password/client-credentials grants to the token endpoint, never authorize.","Whitelist and trim response_type at the client before building the authorize URL."],"tags":["oauth2","response-type","authorize-endpoint","sa-token"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}