What causes "无效 response_type: " in dromara/Sa-Token?

Use response_type=code for authorization-code flow or response_type=token for implicit flow

dromara/Sa-Token · error · SaOAuth2Exception

30125

30125

Error message

无效 response_type:

What it means

Thrown by SaOAuth2ServerProcessor.authorize when response_type is neither 'code' nor 'token'. sa-token's authorize endpoint only supports the authorization-code and implicit flows; any other value falls through to this rejection. Error code 30125.

Source

Thrown at sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java:167

		}

		// 8、判断授权类型，重定向到不同地址
		// 		如果是 授权码式，则：开始重定向授权，下放code
		if(ResponseType.code.equals(ra.responseType)) {
			CodeModel codeModel = dataGenerate.generateCode(ra);
			String redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
			return res.redirect(redirectUri);
		}
		
		// 		如果是 隐藏式，则：开始重定向授权，下放 token
		if(ResponseType.token.equals(ra.responseType)) {
			AccessTokenModel at = dataGenerate.generateAccessToken(ra, false, null);
			String redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
			return res.redirect(redirectUri);
		}

		// 默认返回
		throw new SaOAuth2Exception("无效 response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
	}

	/**
	 * Code 换 Access-Token / 模式三：密码式 / 自定义 grant_type
	 * @return 处理结果
	 */
	public Object token() {
		AccessTokenModel accessTokenModel = SaOAuth2Strategy.instance.grantTypeAuth.apply(SaHolder.getRequest());
		return SaOAuth2Manager.getDataResolver().buildAccessTokenReturnValue(accessTokenModel);
	}

	/**
	 * Refresh-Token 刷新 Access-Token
	 * @return 处理结果
	 */
	public Object refresh() {
		SaRequest req = SaHolder.getRequest();

View on GitHub (pinned to ac2c7f6e94)

Solutions

Use response_type=code for authorization-code flow or response_type=token for implicit flow
Check for typos and URL-encoding issues in the response_type parameter
If you need another flow (e.g. client_credentials or password), call /oauth2/token with the right grant_type instead of /oauth2/authorize

Example fix

// before
/oauth2/authorize?client_id=1001&response_type=code%20token&...

// after
/oauth2/authorize?client_id=1001&response_type=code&redirect_uri=...&scope=getuserinfo

Defensive patterns

Strategy: validation

Validate before calling

Set<String> supported = new HashSet<>(Arrays.asList("code", "token"));
if(!supported.contains(responseType)) {
    throw new IllegalArgumentException("response_type must be code or token");
}

Try / catch

catch(SaOAuth2Exception e) { if("30125".equals(e.getCode())) return badRequest("unsupported response_type: " + e.getMessage()); }

Prevention

Hardcode response_type=code unless implicit flow is explicitly needed
Add a client-side enum for response types to prevent typos

When it happens

Trigger: GET/POST /oauth2/authorize with response_type missing (empty string), or set to unsupported values like 'code token', 'id_token', or 'device_code'.

Common situations: Developer expects OIDC hybrid flow or PKCE-style response types that sa-token does not implement; typo such as response_type=codes; frontend reads an undefined JS variable so the param is sent empty.

Related errors

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/5b392a8f527dfd81. Report an issue: GitHub.