{"record":{"id":"b0067be3a1e3e9b3","repo":"justauth/JustAuth","slug":"error-no","errorCode":"${error_no}","errorMessage":"${error_desc}","messagePattern":"\\$\\{error_desc\\}","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthXmlyRequest.java","lineNumber":121,"sourceCode":"        return AuthUser.builder()\n            .uuid(object.getString(\"id\"))\n            .nickname(object.getString(\"nickname\"))\n            .avatar(object.getString(\"avatar_url\"))\n            .rawUserInfo(object)\n            .source(source.toString())\n            .token(authToken)\n            .gender(AuthUserGender.UNKNOWN)\n            .build();\n    }\n\n    /**\n     * 校验响应结果\n     *\n     * @param object 接口返回的结果\n     */\n    private void checkResponse(JSONObject object) {\n        if (object.containsKey(\"errcode\")) {\n            throw new AuthException(object.getIntValue(\"error_no\"), object.getString(\"error_desc\"));\n        }\n    }\n}\n","sourceCodeStart":103,"sourceCodeEnd":125,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthXmlyRequest.java#L103-L125","documentation":"AuthXmlyRequest.checkResponse is intended to surface Ximalaya (Xmly) API errors: it throws AuthException(error_no, error_desc) with the numeric error_no as the exception code. However the guard contains a key-mismatch defect: the condition tests containsKey(\"errcode\") while the thrown values are read from \"error_no\"/\"error_desc\". If Ximalaya actually returns `error_no` (as its API docs suggest), the check never fires; if it returns `errcode`, the exception carries code 0 and a null message.","triggerScenarios":"Any Ximalaya endpoint response containing an `errcode` key (per the current guard): the exception is thrown with error_no/error_desc fields which may be absent, producing AuthException(0, null). Responses containing only error_no silently pass the check.","commonSituations":"Ximalaya open-platform API errors (invalid app_key/app_secret, expired access token, signature failures) either being swallowed or surfacing as a codeless, messageless AuthException that is hard to diagnose; behavior differences across JustAuth versions if the key names changed.","solutions":["Upgrade JustAuth to the latest version — check the changelog/commits for a fix to AuthXmlyRequest.checkResponse key handling.","If unpatched in your version, subclass AuthXmlyRequest and override/replicate checkResponse with the correct keys (`object.containsKey(\"error_no\")`), reading error_no/error_desc.","Log the raw response body for Ximalaya calls until diagnosed — the exception may carry no useful text due to the mismatch.","Verify Ximalaya app credentials and token freshness independently via the Ximalaya docs once raw responses are visible."],"exampleFix":"// before (library code, buggy key pair)\nprivate void checkResponse(JSONObject object) {\n    if (object.containsKey(\"errcode\")) {\n        throw new AuthException(object.getIntValue(\"error_no\"), object.getString(\"error_desc\"));\n    }\n}\n\n// after — local subclass with consistent keys\npublic class FixedXmlyRequest extends AuthXmlyRequest {\n    public FixedXmlyRequest(AuthConfig c) { super(c); }\n    // re-implement the private checkResponse logic by overriding the public\n    // entry points (getAccessToken/getUserInfo) and validating error_no there:\n    // if (object.containsKey(\"error_no\"))\n    //     throw new AuthException(object.getIntValue(\"error_no\"), object.getString(\"error_desc\"));\n}","handlingStrategy":"try-catch","validationCode":"// verify Xmly credentials present and log raw body defensively\nif (StringUtils.isAnyEmpty(config.getClientId(), config.getClientSecret())) {\n    throw new IllegalArgumentException(\"Ximalaya app_key/app_secret required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    AuthUser u = xmlyRequest.getUserInfo(token);\n} catch (AuthException e) {\n    // guard has a key mismatch: message may be null/code 0\n    log.warn(\"Xmly failure, code={} msg={} — inspect raw response manually\", e.getCode(), e.getMessage());\n    redirect(xmlyRequest.authorize(newState()));\n}","preventionTips":["Upgrade JustAuth regularly and watch release notes for AuthXmlyRequest fixes.","Log raw Ximalaya HTTP bodies until error handling is confirmed correct.","Write a unit test asserting checkResponse fires on an error_no payload to expose the key mismatch."],"tags":["justauth","ximalaya","api-error","bug","key-mismatch"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}