justauth/JustAuth · error · AuthException

5006

5006

Error message

Illegal redirect uri

What it means

Thrown by AuthChecker.checkConfig during AuthRequest construction (or first use) when the AuthConfig has no redirectUri at all. JustAuth validates up front that every platform (except when explicitly opted out) has a callback URL configured, because the OAuth2 redirect flow cannot proceed without one. The error carries code 5006 (AuthResponseStatus.ILLEGAL_REDIRECT_URI) plus the source that failed. It fires before any network call is made, so it is purely a local configuration defect.

Source

Thrown at src/main/java/me/zhyd/oauth/utils/AuthChecker.java:61

            }
        }
        return isSupported;
    }

    /**
     * 检查配置合法性。针对部分平台， 对redirect uri有特定要求。一般来说redirect uri都是http://，而对于facebook平台， redirect uri 必须是https的链接
     *
     * @param config config
     * @param source source
     * @since 1.6.1-beta
     */
    public static void checkConfig(AuthConfig config, AuthSource source) {
        String redirectUri = config.getRedirectUri();
        if (config.isIgnoreCheckRedirectUri()) {
            return;
        }
        if (StringUtils.isEmpty(redirectUri)) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);
        }
        if (!GlobalAuthUtils.isHttpProtocol(redirectUri) && !GlobalAuthUtils.isHttpsProtocol(redirectUri)) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);
        }
    }

    /**
     * 校验回调传回的code
     * <p>
     * {@code v1.10.0}版本中改为传入{@code source}和{@code callback}，对于不同平台使用不同参数接受code的情况统一做处理
     *
     * @param source   当前授权平台
     * @param callback 从第三方授权回调回来时传入的参数集合
     * @since 1.8.0
     */
    public static void checkCode(AuthSource source, AuthCallback callback) {
        // 推特平台不支持回调 code 和 state
        if (source == AuthDefaultSource.TWITTER) {

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. Set a non-empty redirectUri in AuthConfig, e.g. AuthConfig.builder().redirectUri("http://localhost:8080/oauth/callback/github")... — it must exactly match the callback URL registered with the provider.
  2. If the property comes from config files/env, verify the binding: print config.getRedirectUri() right before building the request, and check the key name and profile (dev/prod) being loaded.
  3. If the platform genuinely does not use a redirect uri (e.g. some WeChat-work or app-embedded flows), set config.ignoreCheckRedirectUri(true) to skip the check deliberately — never as a blanket workaround.
  4. Confirm the value is not whitespace-only; trim it when loading.

Example fix

// before
AuthConfig config = AuthConfig.builder()
    .clientId(clientId)
    .clientSecret(clientSecret)
    .build();
AuthRequest request = new AuthGithubRequest(config, stateCache);

// after
AuthConfig config = AuthConfig.builder()
    .clientId(clientId)
    .clientSecret(clientSecret)
    .redirectUri("http://localhost:8080/oauth/callback/github")
    .build();
AuthRequest request = new AuthGithubRequest(config, stateCache);
Defensive patterns

Strategy: validation

Validate before calling

if (StringUtils.isEmpty(config.getRedirectUri())) {
    throw new IllegalStateException("redirectUri must be configured for " + source.getName());
}
new AuthGithubRequest(config, stateCache);

Try / catch

catch (AuthException e) { if (e.getErrorCode() == AuthResponseStatus.ILLEGAL_REDIRECT_URI.getCode()) { /* config error: fix deployment, alert dev */ } }

Prevention

When it happens

Trigger: Creating an AuthRequest via AuthRequestBuilder.build() (or new AuthXxxRequest(...)) with an AuthConfig whose redirectUri field is null or empty string, while config.ignoreCheckRedirectUri is false (the default). Example: new AuthGithubRequest(AuthConfig.builder().clientId(id).clientSecret(sec).build(), state).authorize(state) — no redirectUri set.

Common situations: Copying a JustAuth demo snippet that omits setRedirectUri; reading config from application.yml/properties where the redirect-uri key is misspelled or the env var backing it is unset so it resolves to empty; migrating a project where redirectUri was hardcoded for a different platform and got dropped; testing locally and assuming the library will default the callback.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/d6e5b711b103336c. Report an issue: GitHub.