What causes "Illegal redirect uri" in justauth/JustAuth?

Set AuthConfig.redirectUri to an https:// URL, e.g. https://dev.example.com/oauth/facebook/callback.

justauth/JustAuth · error · AuthException

5006

5006

Error message

Illegal redirect uri

What it means

A local validation error thrown from AuthFacebookRequest.checkConfig() (code 5006, ILLEGAL_REDIRECT_URI): Facebook requires OAuth redirect URIs to use HTTPS, so JustAuth refuses to construct the request when config.redirectUri does not start with https://. Thrown at request construction, before any network traffic.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java:98

     *
     * @param authToken 用户token
     * @return 返回获取userInfo的url
     */
    @Override
    protected String userInfoUrl(AuthToken authToken) {
        return UrlBuilder.fromBaseUrl(source.userInfo())
            .queryParam("access_token", authToken.getAccessToken())
            .queryParam("fields", "id,name,birthday,gender,hometown,email,devices,picture.width(400),link")
            .build();
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        // facebook的回调地址必须为https的链接
        if (AuthDefaultSource.FACEBOOK == source && !GlobalAuthUtils.isHttpsProtocol(config.getRedirectUri())) {
            // Facebook's redirect uri must use the HTTPS protocol
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);
        }
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error")) {
            throw new AuthException(object.getJSONObject("error").getString("message"));
        }
    }

    /**
     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}
     *
     * @param state state 验证授权流程的参数，可以防止csrf

View on GitHub (pinned to 694bbf1b01)

Solutions

Set AuthConfig.redirectUri to an https:// URL, e.g. https://dev.example.com/oauth/facebook/callback.
For local development, tunnel HTTPS to your machine (e.g. ngrok http 8080) and register that https callback with Facebook.
If running behind a reverse proxy, forward X-Forwarded-Proto and build the redirect URI from it so the app sees https.
Double-check the exact same https callback is registered in the Facebook app console (App Settings > Valid OAuth Redirect URIs).

Example fix

// before
AuthConfig config = AuthConfig.builder()
    .clientId(id).clientSecret(secret)
    .redirectUri("http://localhost:8080/oauth/facebook/callback") // throws 5006
    .build();

// after
AuthConfig config = AuthConfig.builder()
    .clientId(id).clientSecret(secret)
    .redirectUri("https://dev.example.com/oauth/facebook/callback")
    .build();

Defensive patterns

Strategy: validation

Validate before calling

// Reject non-HTTPS redirect before constructing the request
public AuthConfig buildFacebookConfig(String id, String secret, String redirectUri) {
    if (redirectUri == null || !redirectUri.startsWith("https://")) {
        throw new IllegalStateException("Facebook redirectUri must use HTTPS: " + redirectUri);
    }
    return AuthConfig.builder().clientId(id).clientSecret(secret).redirectUri(redirectUri).build();
}

Try / catch

try {
    return new AuthFacebookRequest(config, AuthDefaultSource.FACEBOOK);
} catch (AuthException e) {
    if (e.getErrorCode() == 5006) {
        throw new ConfigurationException("Facebook requires an https:// redirectUri", e);
    }
    throw e;
}

Prevention

Enforce https:// redirect URIs in config validation for every provider, not just Facebook.
Use an HTTPS tunnel (ngrok and similar) for local OAuth testing instead of http://localhost.
Behind proxies, derive the callback URL from X-Forwarded-Proto so the built redirect is always https.

When it happens

Trigger: Building AuthFacebookRequest (or any request whose source resolves to AuthDefaultSource.FACEBOOK) with an AuthConfig whose redirectUri is http://... - typical when running locally with http://localhost:8080/callback.

Common situations: Local development against http://localhost; deploying behind a TLS-terminating proxy where the app builds the redirect from the request scheme and sees http; copy-pasting a staging URL with the wrong scheme into the config.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/ead5846151585798. Report an issue: GitHub.