What causes "Not Implemented" in justauth/JustAuth?

Override `String authorize(String state)` in your custom AuthRequest implementation and return the provider's authorize URL.

justauth/JustAuth · error · AuthException

5001

5001

Error message

Not Implemented

What it means

AuthRequest is the top-level JustAuth interface. authorize(String state) is a default method that unconditionally throws AuthException with AuthResponseStatus.NOT_IMPLEMENTED (code 5001). The library expects each concrete request class to override it; the default exists only so hand-written implementations compile. This specific variant is the stateful authorize used to build the redirect URL for the OAuth flow.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthRequest.java:34

 * {@link AuthRequest#revoke(AuthToken)}
 * {@link AuthRequest#refresh(AuthToken)}
 *
 * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
 * @since 1.8
 */
public interface AuthRequest {

    /**
     * 返回授权url，可自行跳转页面
     * <p>
     * 不建议使用该方式获取授权地址，不带{@code state}的授权地址，容易受到csrf攻击。
     * 建议使用{@link AuthDefaultRequest#authorize(String)}方法生成授权地址，在回调方法中对{@code state}进行校验
     *
     * @return 返回授权地址
     */
    @Deprecated
    default String authorize() {
        throw new AuthException(AuthResponseStatus.NOT_IMPLEMENTED);
    }

    /**
     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}
     *
     * @param state state 验证授权流程的参数，可以防止csrf
     * @return 返回授权地址
     */
    default String authorize(String state) {
        throw new AuthException(AuthResponseStatus.NOT_IMPLEMENTED);
    }

    /**
     * 获取access token
     *
     * @param authCallback 授权成功后的回调参数
     * @return token
     * @see AuthDefaultRequest#authorize()

View on GitHub (pinned to 694bbf1b01)

Solutions

Override `String authorize(String state)` in your custom AuthRequest implementation and return the provider's authorize URL.
Extend AuthDefaultRequest instead of implementing AuthRequest from scratch — it already implements authorize(state) via the source definition.
If you only need the URL for a built-in provider, use AuthRequestBuilder.build() (JustAuth.request(...)) so a fully implemented class is returned.

Example fix

// before
class MyRequest implements AuthRequest {
    public AuthToken getAccessToken(AuthCallback c) { ... }
    public AuthUser getUserInfo(AuthToken t) { ... }
}
String url = new MyRequest(...).authorize("state"); // AuthException 5001

// after
class MyRequest extends AuthDefaultRequest {
    public MyRequest(AuthConfig c) { super(c, AuthDefaultSource.MY_PROVIDER); }
    // authorize(String) inherited and functional
}
String url = new MyRequest(config).authorize("state");

Defensive patterns

Strategy: validation

Validate before calling

// before building URLs, ensure the implementation really supports authorize
if (request instanceof AuthDefaultRequest) {
    String url = request.authorize(state);
} else {
    throw new IllegalStateException("AuthRequest implementation must extend AuthDefaultRequest or override authorize(String)");
}

Type guard

boolean supportsAuthorize(AuthRequest r) {
    return r instanceof AuthDefaultRequest
        || Arrays.stream(r.getClass().getMethods())
               .anyMatch(m -> m.getName().equals("authorize") && !m.isDefault() && m.getDeclaringClass() != AuthRequest.class);
}

Try / catch

try { url = request.authorize(state); }
catch (AuthException e) {
    if (e.getCode() == 5001) throw new IllegalStateException("authorize not implemented by " + request.getClass().getName(), e);
    throw e;
}

Prevention

Always extend AuthDefaultRequest for custom providers instead of implementing AuthRequest directly.
Add an architecture test (ArchUnit) that custom AuthRequest classes extend AuthDefaultRequest.
Cover custom implementations with a smoke test invoking authorize(state), login, revoke, refresh.

When it happens

Trigger: Calling authRequest.authorize("someState") on an implementation that does not override authorize(String) — e.g. a custom class that implements AuthRequest directly but only implements getAccessToken/getUserInfo, or a mock/stub passed in tests.

Common situations: Writing a custom AuthRequest for an unsupported provider and forgetting the authorize override; unit tests with anonymous AuthRequest implementations; refactoring away from AuthDefaultRequest.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/197f9e0f4df80c4d. Report an issue: GitHub.