{"record":{"id":"d6e5b711b103336c","repo":"justauth/JustAuth","slug":"5006-d6e5b7","errorCode":"5006","errorMessage":"Illegal redirect uri","messagePattern":"Illegal redirect uri","errorType":"validation","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/utils/AuthChecker.java","lineNumber":61,"sourceCode":"            }\n        }\n        return isSupported;\n    }\n\n    /**\n     * 检查配置合法性。针对部分平台， 对redirect uri有特定要求。一般来说redirect uri都是http://，而对于facebook平台， redirect uri 必须是https的链接\n     *\n     * @param config config\n     * @param source source\n     * @since 1.6.1-beta\n     */\n    public static void checkConfig(AuthConfig config, AuthSource source) {\n        String redirectUri = config.getRedirectUri();\n        if (config.isIgnoreCheckRedirectUri()) {\n            return;\n        }\n        if (StringUtils.isEmpty(redirectUri)) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);\n        }\n        if (!GlobalAuthUtils.isHttpProtocol(redirectUri) && !GlobalAuthUtils.isHttpsProtocol(redirectUri)) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);\n        }\n    }\n\n    /**\n     * 校验回调传回的code\n     * <p>\n     * {@code v1.10.0}版本中改为传入{@code source}和{@code callback}，对于不同平台使用不同参数接受code的情况统一做处理\n     *\n     * @param source   当前授权平台\n     * @param callback 从第三方授权回调回来时传入的参数集合\n     * @since 1.8.0\n     */\n    public static void checkCode(AuthSource source, AuthCallback callback) {\n        // 推特平台不支持回调 code 和 state\n        if (source == AuthDefaultSource.TWITTER) {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/utils/AuthChecker.java#L43-L79","documentation":"Thrown by AuthChecker.checkConfig during AuthRequest construction (or first use) when the AuthConfig has no redirectUri at all. JustAuth validates up front that every platform (except when explicitly opted out) has a callback URL configured, because the OAuth2 redirect flow cannot proceed without one. The error carries code 5006 (AuthResponseStatus.ILLEGAL_REDIRECT_URI) plus the source that failed. It fires before any network call is made, so it is purely a local configuration defect.","triggerScenarios":"Creating an AuthRequest via AuthRequestBuilder.build() (or new AuthXxxRequest(...)) with an AuthConfig whose redirectUri field is null or empty string, while config.ignoreCheckRedirectUri is false (the default). Example: new AuthGithubRequest(AuthConfig.builder().clientId(id).clientSecret(sec).build(), state).authorize(state) — no redirectUri set.","commonSituations":"Copying a JustAuth demo snippet that omits setRedirectUri; reading config from application.yml/properties where the redirect-uri key is misspelled or the env var backing it is unset so it resolves to empty; migrating a project where redirectUri was hardcoded for a different platform and got dropped; testing locally and assuming the library will default the callback.","solutions":["Set a non-empty redirectUri in AuthConfig, e.g. AuthConfig.builder().redirectUri(\"http://localhost:8080/oauth/callback/github\")... — it must exactly match the callback URL registered with the provider.","If the property comes from config files/env, verify the binding: print config.getRedirectUri() right before building the request, and check the key name and profile (dev/prod) being loaded.","If the platform genuinely does not use a redirect uri (e.g. some WeChat-work or app-embedded flows), set config.ignoreCheckRedirectUri(true) to skip the check deliberately — never as a blanket workaround.","Confirm the value is not whitespace-only; trim it when loading."],"exampleFix":"// before\nAuthConfig config = AuthConfig.builder()\n    .clientId(clientId)\n    .clientSecret(clientSecret)\n    .build();\nAuthRequest request = new AuthGithubRequest(config, stateCache);\n\n// after\nAuthConfig config = AuthConfig.builder()\n    .clientId(clientId)\n    .clientSecret(clientSecret)\n    .redirectUri(\"http://localhost:8080/oauth/callback/github\")\n    .build();\nAuthRequest request = new AuthGithubRequest(config, stateCache);","handlingStrategy":"validation","validationCode":"if (StringUtils.isEmpty(config.getRedirectUri())) {\n    throw new IllegalStateException(\"redirectUri must be configured for \" + source.getName());\n}\nnew AuthGithubRequest(config, stateCache);","typeGuard":null,"tryCatchPattern":"catch (AuthException e) { if (e.getErrorCode() == AuthResponseStatus.ILLEGAL_REDIRECT_URI.getCode()) { /* config error: fix deployment, alert dev */ } }","preventionTips":["Centralize AuthConfig construction in one factory that asserts clientId, clientSecret, redirectUri are non-empty.","Fail fast at application startup: validate all platform configs on boot, not on first user login.","Use typed config properties (@ConfigurationProperties) so missing keys are caught by framework binding."],"tags":["java","justauth","oauth","configuration","redirect-uri"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}