{"record":{"id":"8a881841a954f8fc","repo":"justauth/JustAuth","slug":"5006","errorCode":"5006","errorMessage":"Illegal redirect uri","messagePattern":"Illegal redirect uri","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java","lineNumber":138,"sourceCode":"        this.alipayClient = new DefaultAlipayClient(GATEWAY, config.getClientId(), config.getClientSecret(),\n            \"json\", \"UTF-8\", this.alipayPublicKey, \"RSA2\", proxyHost, proxyPort);\n    }\n\n    private String determineAlipayPublicKey(String alipayPublicKey, AuthConfig config) {\n        return alipayPublicKey != null ? alipayPublicKey : config.getAlipayPublicKey();\n    }\n\n    protected void check(AuthConfig config) {\n        AuthChecker.checkConfig(config, AuthDefaultSource.ALIPAY);\n\n        if (!StringUtils.isNotEmpty(alipayPublicKey)) {\n            throw new AuthException(AuthResponseStatus.PARAMETER_INCOMPLETE, AuthDefaultSource.ALIPAY);\n        }\n\n        // 支付宝在创建回调地址时，不允许使用localhost或者127.0.0.1\n        if (GlobalAuthUtils.isLocalHost(config.getRedirectUri())) {\n            // The redirect uri of alipay is forbidden to use localhost or 127.0.0.1\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, AuthDefaultSource.ALIPAY);\n        }\n    }\n\n    @Override\n    protected void checkCode(AuthCallback authCallback) {\n        if (StringUtils.isEmpty(authCallback.getAuth_code())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);\n        }\n    }\n\n    @Override\n    public AuthToken getAccessToken(AuthCallback authCallback) {\n        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();\n        request.setGrantType(\"authorization_code\");\n        request.setCode(authCallback.getAuth_code());\n        AlipaySystemOauthTokenResponse response;\n        try {\n            response = this.alipayClient.execute(request);","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java#L120-L156","documentation":"AuthException with AuthResponseStatus.ILLEGAL_REDIRECT_URI (code 5006) thrown from AuthAlipayRequest.check because GlobalAuthUtils.isLocalHost(config.getRedirectUri()) is true. Alipay rejects callback URLs containing localhost or 127.0.0.1, so JustAuth fails fast at construction.","triggerScenarios":"AuthConfig.redirectUri is http://localhost:8080/callback or http://127.0.0.1:8080/callback while building an Alipay request. The check runs after the base config check whenever the request object is instantiated.","commonSituations":"Leftover dev-machine default redirect URI promoted to a shared config; testing locally against Alipay sandbox; using an internal hostname that resolves through a hosts file to 127.0.0.1 but the literal string is 'localhost'.","solutions":["Use a publicly reachable host in redirectUri, e.g. https://your.domain.com/oauth/callback/alipay","For local development, use a tunnel (ngrok/frp) or an intranet-penetrating domain and register that exact URL in the Alipay open platform","Keep provider-specific redirect URIs in per-profile config instead of one shared localhost default"],"exampleFix":"// before\n.redirectUri(\"http://localhost:8080/callback\")\n\n// after\n.redirectUri(\"https://your.domain.com/callback/alipay\")","handlingStrategy":"validation","validationCode":"URI uri = URI.create(config.getRedirectUri());\nString host = uri.getHost();\nif (\"localhost\".equals(host) || \"127.0.0.1\".equals(host)) {\n    throw new IllegalStateException(\"ALIPAY redirect uri must not use localhost/127.0.0.1\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Register the exact production callback URL in the Alipay console and reuse it verbatim","Use tunnels for local testing instead of localhost","Fail fast on localhost redirect URIs in CI config checks"],"tags":["alipay","config","redirect-uri","validation"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}