dromara/Sa-Token · error · SaOAuth2Exception

30125

30125

Error message

无效 response_type: ${responseType}

What it means

SaOAuth2Exception (error code 30125) thrown by the demo OAuth2 server's H5 authorize controller when the response_type parameter is neither 'code' (authorization-code mode) nor 'token' (implicit mode). It marks the fall-through case after both supported response types have been checked, meaning the request asked for an unsupported or misspelled grant flow.

Source

Thrown at sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/h5/SaOAuth2ServerH5Controller.java:94

        }

        // 8、判断授权类型，重定向到不同地址
        // 		如果是 授权码式，则：开始重定向授权，下放code
        if(SaOAuth2Consts.ResponseType.code.equals(ra.responseType)) {
            CodeModel codeModel = dataGenerate.generateCode(ra);
            String redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
            return SaResult.ok().set("redirect_uri", redirectUri);
        }

        // 		如果是 隐藏式，则：开始重定向授权，下放 token
        if(SaOAuth2Consts.ResponseType.token.equals(ra.responseType)) {
            AccessTokenModel at = dataGenerate.generateAccessToken(ra, false, null);
            String redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
            return SaResult.ok().set("redirect_uri", redirectUri);
        }

        // 默认返回
        throw new SaOAuth2Exception("无效 response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
    }

}

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Set response_type=code (authorization-code flow) or response_type=token (implicit flow) on the authorize request.
2. If you intended password or client_credentials mode, call the token endpoint (/oauth2/token) directly instead of the authorize endpoint.
3. Trim and lowercase the parameter before sending; comparison is exact String.equals against constants.
4. Check SaOAuth2ErrorCode.CODE_30125 documentation for the full list of valid response types in your sa-token version.

Example fix

// before
http://localhost:8001/oauth2/authorize?response_type=password&client_id=xxx&redirect_uri=xxx

// after
http://localhost:8001/oauth2/authorize?response_type=code&client_id=xxx&redirect_uri=xxx
// (password-mode belongs on the token endpoint, not authorize)

String rt = ra.responseType == null ? "" : ra.responseType.trim();
if (!("code".equals(rt) || "token".equals(rt))) {
    return SaResult.error("response_type must be code or token on the authorize endpoint");
}

boolean isValidResponseType(String v) { return "code".equals(v) || "token".equals(v); }

try { ... } catch (SaOAuth2Exception e) { if (e.getCode() == SaOAuth2ErrorCode.CODE_30125) { /* surface to client as invalid_request */ } }

When it happens

Trigger: GET /oauth2/authorize with response_type=password, response_type=client_token, or a typo like 'code ' (trailing space) or 'Token' (case-sensitive compare via SaOAuth2Consts.ResponseType). Any value not exactly 'code' or 'token' hits the default throw.

Common situations: Client configured for password-mode or client-credentials-mode authorization but pointed at the authorize endpoint (those flows use the token endpoint, not authorize); copy-pasting response_type from another OAuth2 provider's docs; trailing whitespace from a properties/yml value.

Related errors

• 30125
• 10004
• 30127
• 30105
• 30101

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/5d003fcecd3464b6. Report an issue: GitHub.