{"record":{"id":"cf85e0a66aeb865a","repo":"justauth/JustAuth","slug":"object-getstring-msg","errorCode":null,"errorMessage":"object.getString(\"msg\")","messagePattern":"object\\.getString\\(\"msg\"\\)","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthCodingRequest.java","lineNumber":75,"sourceCode":"            .nickname(object.getString(\"name\"))\n            .company(object.getString(\"company\"))\n            .location(object.getString(\"location\"))\n            .gender(AuthUserGender.getRealGender(object.getString(\"sex\")))\n            .email(object.getString(\"email\"))\n            .remark(object.getString(\"slogan\"))\n            .token(authToken)\n            .source(source.toString())\n            .build();\n    }\n\n    /**\n     * 检查响应内容是否正确\n     *\n     * @param object 请求响应内容\n     */\n    private void checkResponse(JSONObject object) {\n        if (object.getIntValue(\"code\") != 0) {\n            throw new AuthException(object.getString(\"msg\"));\n        }\n    }\n\n    /**\n     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}\n     *\n     * @param state state 验证授权流程的参数，可以防止csrf\n     * @return 返回授权地址\n     * @since 1.9.3\n     */\n    @Override\n    public String authorize(String state) {\n        return UrlBuilder.fromBaseUrl(String.format(source.authorize(), config.getDomainPrefix()))\n            .queryParam(\"response_type\", \"code\")\n            .queryParam(\"client_id\", config.getClientId())\n            .queryParam(\"redirect_uri\", config.getRedirectUri())\n            .queryParam(\"scope\", this.getScopes(\" \", true, AuthScopeUtils.getDefaultScopes(AuthCodingScope.values())))\n            .queryParam(\"state\", getRealState(state))","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthCodingRequest.java#L57-L93","documentation":"The CODING (AuthCodingRequest) adapter inspects every API response for a top-level numeric 'code' field; anything other than 0 means CODING rejected the request, and JustAuth throws AuthException carrying the 'msg' string from the same response body. It fires for both token exchange and user-info calls.","triggerScenarios":"getAccessToken() or getUserInfo() on AuthCodingRequest when the CODING OAuth server returns code != 0 - wrong client secret, expired/redeemed code, or an access token that has been revoked or expired.","commonSituations":"Team/client credentials rotated in the CODING admin without updating AuthConfig, callback handler replaying an old code after a page refresh, or long-running sessions whose access token expired and no refreshToken workflow was implemented.","solutions":["Confirm clientId/clientSecret (and teamId if configured) are current in the CODING enterprise settings.","Guard against code replay: cache the state and consume the AuthCallback code on first use only.","If the token is expired, call refresh() with the stored refresh token instead of getUserInfo() with the stale access token.","Catch AuthException and surface e.getErrorMsg() - it is CODING's own 'msg' text describing the failure."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    return codingRequest.getAccessToken(callback);\n} catch (AuthException e) {\n    log.warn(\"CODING error: {}\", e.getErrorMsg());\n    if (String.valueOf(e.getErrorMsg()).contains(\"invalid code\")) {\n        return AuthResponse.builder().code(AuthResponseStatus.FAILURE.getCode()).msg(\"authorization code consumed or expired\").build();\n    }\n    throw e;\n}","preventionTips":["Persist the OAuth state and reject duplicate callback submissions for the same code.","Automate credential rotation: pull client secret from a secrets manager instead of hardcoding.","Wrap the whole login flow in one AuthException handler so provider errors map to user-friendly messages."],"tags":["oauth","coding","justauth","api-error","auth-exception"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}