What causes "Illegal redirect uri" in justauth/JustAuth?

Change redirectUri to https://your-domain/callback

justauth/JustAuth · error · AuthException

5006

5006

Error message

Illegal redirect uri

What it means

AuthMicrosoftCnRequest.checkConfig throws AuthException with code 5006 (ILLEGAL_REDIRECT_URI, msg 'Illegal redirect uri') when the configured redirectUri for the Microsoft (China / 21Vianet) source is not HTTPS and not localhost. Azure China requires HTTPS回调 addresses.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthMicrosoftCnRequest.java:32

 * @since 1.16.4
 */
public class AuthMicrosoftCnRequest extends AbstractAuthMicrosoftRequest {

    public AuthMicrosoftCnRequest(AuthConfig config) {
        super(config, AuthDefaultSource.MICROSOFT_CN);
    }

    public AuthMicrosoftCnRequest(AuthConfig config, AuthStateCache authStateCache) {
        super(config, AuthDefaultSource.MICROSOFT_CN, authStateCache);
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        // 微软中国的回调地址必须为https的链接或者localhost,不允许使用http
        if (AuthDefaultSource.MICROSOFT_CN == source && !GlobalAuthUtils.isHttpsProtocolOrLocalHost(config.getRedirectUri())) {
            // Microsoft's redirect uri must use the HTTPS or localhost
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);
        }
    }

}

View on GitHub (pinned to 694bbf1b01)

Solutions

Change redirectUri to https://your-domain/callback
For local testing use http://localhost:<port>/callback (localhost is explicitly allowed)
If testing on another machine, map a hosts entry to localhost or use a self-signed-cert HTTPS proxy
Ensure the same HTTPS URL is registered as a redirect URI in the Azure CN app registration

Example fix

// before
AuthConfig cfg = AuthConfig.builder()
    .clientId(id).clientSecret(secret)
    .redirectUri("http://192.168.1.5:8080/callback")
    .build();

// after
AuthConfig cfg = AuthConfig.builder()
    .clientId(id).clientSecret(secret)
    .redirectUri("http://localhost:8080/callback") // or https://... in prod
    .build();

Defensive patterns

Strategy: validation

Validate before calling

String uri = config.getRedirectUri();
boolean ok = uri != null && (uri.startsWith("https://") || uri.startsWith("http://localhost") || uri.startsWith("http://127.0.0.1"));
if (!ok) throw new IllegalArgumentException("Redirect URI must be https or localhost for Microsoft CN");

Type guard

null

Try / catch

try {
    new AuthMicrosoftCnRequest(config, stateCache);
} catch (AuthException e) {
    if (e.getCode() == 5006) { /* fix redirectUri to https/localhost */ }
}

Prevention

Enforce https redirect URIs in all environments except localhost dev
Externalize redirectUri per environment (profile-based config)
Register the exact https callback in the Azure CN app registration

When it happens

Trigger: Instantiating AuthMicrosoftCnRequest (any constructor) with a redirectUri starting with http:// that is not http://localhost... — the check runs before any network call.

Common situations: Local development over http://192.168.x.x or a LAN hostname, deploying behind a proxy that terminates TLS but config left as http, or copy-pasting the international-Azure (non-CN) redirect into the CN app.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/5cf93bb98e0bf49e. Report an issue: GitHub.