justauth/JustAuth · error · AuthException

5006

5006

Error message

Illegal redirect uri

What it means

Same guard as the CN variant but for AuthDefaultSource.MICROSOFT (global Azure): checkConfig throws AuthException code 5006 'Illegal redirect uri' when redirectUri is not HTTPS and not localhost. Azure AD enforces HTTPS for redirect URIs (localhost exempted for dev).

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthMicrosoftRequest.java:33

 * @since 1.5.0
 */
public class AuthMicrosoftRequest extends AbstractAuthMicrosoftRequest {

    public AuthMicrosoftRequest(AuthConfig config) {
        super(config, AuthDefaultSource.MICROSOFT);
    }

    public AuthMicrosoftRequest(AuthConfig config, AuthStateCache authStateCache) {
        super(config, AuthDefaultSource.MICROSOFT, authStateCache);
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        // 微软的回调地址必须为https的链接或者localhost,不允许使用http
        if (AuthDefaultSource.MICROSOFT == source && !GlobalAuthUtils.isHttpsProtocolOrLocalHost(config.getRedirectUri())) {
            // Microsoft's redirect uri must use the HTTPS or localhost
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);
        }
    }

}

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. Use an https:// redirectUri matching the app registration in Azure Portal
  2. Use http://localhost:port for local development
  3. If behind a reverse proxy, configure the public https URL in AuthConfig (not the internal hop)
  4. Register the exact URI (path and query-less) in Azure AD's Authentication blade

Example fix

// before
.redirectUri("http://myapp.example.com/callback")

// after
.redirectUri("https://myapp.example.com/callback")
Defensive patterns

Strategy: validation

Validate before calling

String uri = config.getRedirectUri();
if (uri == null || !(uri.startsWith("https://") || uri.startsWith("http://localhost"))) {
    throw new IllegalArgumentException("Microsoft redirectUri must be https or localhost");
}

Type guard

null

Try / catch

try {
    new AuthMicrosoftRequest(config, stateCache);
} catch (AuthException e) {
    if (e.getCode() == 5006) { config = config.toBuilder().redirectUri("https://...").build(); }
}

Prevention

When it happens

Trigger: Constructing AuthMicrosoftRequest with an http:// redirectUri other than localhost; thrown immediately from the constructor, before any HTTP traffic.

Common situations: Dev servers exposed on LAN IPs, staging environments without TLS, proxy setups where the external URL is https but config keeps the internal http one.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/2cb03e36ae9f6456. Report an issue: GitHub.