{"record":{"id":"ead5846151585798","repo":"justauth/JustAuth","slug":"5006-ead584","errorCode":"5006","errorMessage":"Illegal redirect uri","messagePattern":"Illegal redirect uri","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java","lineNumber":98,"sourceCode":"     *\n     * @param authToken 用户token\n     * @return 返回获取userInfo的url\n     */\n    @Override\n    protected String userInfoUrl(AuthToken authToken) {\n        return UrlBuilder.fromBaseUrl(source.userInfo())\n            .queryParam(\"access_token\", authToken.getAccessToken())\n            .queryParam(\"fields\", \"id,name,birthday,gender,hometown,email,devices,picture.width(400),link\")\n            .build();\n    }\n\n    @Override\n    protected void checkConfig(AuthConfig config) {\n        super.checkConfig(config);\n        // facebook的回调地址必须为https的链接\n        if (AuthDefaultSource.FACEBOOK == source && !GlobalAuthUtils.isHttpsProtocol(config.getRedirectUri())) {\n            // Facebook's redirect uri must use the HTTPS protocol\n            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);\n        }\n    }\n\n    /**\n     * 检查响应内容是否正确\n     *\n     * @param object 请求响应内容\n     */\n    private void checkResponse(JSONObject object) {\n        if (object.containsKey(\"error\")) {\n            throw new AuthException(object.getJSONObject(\"error\").getString(\"message\"));\n        }\n    }\n\n    /**\n     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}\n     *\n     * @param state state 验证授权流程的参数，可以防止csrf","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java#L80-L116","documentation":"A local validation error thrown from AuthFacebookRequest.checkConfig() (code 5006, ILLEGAL_REDIRECT_URI): Facebook requires OAuth redirect URIs to use HTTPS, so JustAuth refuses to construct the request when config.redirectUri does not start with https://. Thrown at request construction, before any network traffic.","triggerScenarios":"Building AuthFacebookRequest (or any request whose source resolves to AuthDefaultSource.FACEBOOK) with an AuthConfig whose redirectUri is http://... - typical when running locally with http://localhost:8080/callback.","commonSituations":"Local development against http://localhost; deploying behind a TLS-terminating proxy where the app builds the redirect from the request scheme and sees http; copy-pasting a staging URL with the wrong scheme into the config.","solutions":["Set AuthConfig.redirectUri to an https:// URL, e.g. https://dev.example.com/oauth/facebook/callback.","For local development, tunnel HTTPS to your machine (e.g. ngrok http 8080) and register that https callback with Facebook.","If running behind a reverse proxy, forward X-Forwarded-Proto and build the redirect URI from it so the app sees https.","Double-check the exact same https callback is registered in the Facebook app console (App Settings > Valid OAuth Redirect URIs)."],"exampleFix":"// before\nAuthConfig config = AuthConfig.builder()\n    .clientId(id).clientSecret(secret)\n    .redirectUri(\"http://localhost:8080/oauth/facebook/callback\") // throws 5006\n    .build();\n\n// after\nAuthConfig config = AuthConfig.builder()\n    .clientId(id).clientSecret(secret)\n    .redirectUri(\"https://dev.example.com/oauth/facebook/callback\")\n    .build();","handlingStrategy":"validation","validationCode":"// Reject non-HTTPS redirect before constructing the request\npublic AuthConfig buildFacebookConfig(String id, String secret, String redirectUri) {\n    if (redirectUri == null || !redirectUri.startsWith(\"https://\")) {\n        throw new IllegalStateException(\"Facebook redirectUri must use HTTPS: \" + redirectUri);\n    }\n    return AuthConfig.builder().clientId(id).clientSecret(secret).redirectUri(redirectUri).build();\n}","typeGuard":null,"tryCatchPattern":"try {\n    return new AuthFacebookRequest(config, AuthDefaultSource.FACEBOOK);\n} catch (AuthException e) {\n    if (e.getErrorCode() == 5006) {\n        throw new ConfigurationException(\"Facebook requires an https:// redirectUri\", e);\n    }\n    throw e;\n}","preventionTips":["Enforce https:// redirect URIs in config validation for every provider, not just Facebook.","Use an HTTPS tunnel (ngrok and similar) for local OAuth testing instead of http://localhost.","Behind proxies, derive the callback URL from X-Forwarded-Proto so the built redirect is always https."],"tags":["oauth","facebook","justauth","https","configuration","redirect-uri"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}