justauth/JustAuth · error · AuthException

5006

5006

Error message

Illegal redirect uri

What it means

AuthException with AuthResponseStatus.ILLEGAL_REDIRECT_URI (code 5006) thrown from AuthAlipayRequest.check because GlobalAuthUtils.isLocalHost(config.getRedirectUri()) is true. Alipay rejects callback URLs containing localhost or 127.0.0.1, so JustAuth fails fast at construction.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java:138

        this.alipayClient = new DefaultAlipayClient(GATEWAY, config.getClientId(), config.getClientSecret(),
            "json", "UTF-8", this.alipayPublicKey, "RSA2", proxyHost, proxyPort);
    }

    private String determineAlipayPublicKey(String alipayPublicKey, AuthConfig config) {
        return alipayPublicKey != null ? alipayPublicKey : config.getAlipayPublicKey();
    }

    protected void check(AuthConfig config) {
        AuthChecker.checkConfig(config, AuthDefaultSource.ALIPAY);

        if (!StringUtils.isNotEmpty(alipayPublicKey)) {
            throw new AuthException(AuthResponseStatus.PARAMETER_INCOMPLETE, AuthDefaultSource.ALIPAY);
        }

        // 支付宝在创建回调地址时，不允许使用localhost或者127.0.0.1
        if (GlobalAuthUtils.isLocalHost(config.getRedirectUri())) {
            // The redirect uri of alipay is forbidden to use localhost or 127.0.0.1
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, AuthDefaultSource.ALIPAY);
        }
    }

    @Override
    protected void checkCode(AuthCallback authCallback) {
        if (StringUtils.isEmpty(authCallback.getAuth_code())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);
        }
    }

    @Override
    public AuthToken getAccessToken(AuthCallback authCallback) {
        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();
        request.setGrantType("authorization_code");
        request.setCode(authCallback.getAuth_code());
        AlipaySystemOauthTokenResponse response;
        try {
            response = this.alipayClient.execute(request);

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Use a publicly reachable host in redirectUri, e.g. https://your.domain.com/oauth/callback/alipay
2. For local development, use a tunnel (ngrok/frp) or an intranet-penetrating domain and register that exact URL in the Alipay open platform
3. Keep provider-specific redirect URIs in per-profile config instead of one shared localhost default

Example fix

// before
.redirectUri("http://localhost:8080/callback")

// after
.redirectUri("https://your.domain.com/callback/alipay")

URI uri = URI.create(config.getRedirectUri());
String host = uri.getHost();
if ("localhost".equals(host) || "127.0.0.1".equals(host)) {
    throw new IllegalStateException("ALIPAY redirect uri must not use localhost/127.0.0.1");
}

When it happens

Trigger: AuthConfig.redirectUri is http://localhost:8080/callback or http://127.0.0.1:8080/callback while building an Alipay request. The check runs after the base config check whenever the request object is instantiated.

Common situations: Leftover dev-machine default redirect URI promoted to a shared config; testing locally against Alipay sandbox; using an internal hostname that resolves through a hosts file to 127.0.0.1 but the literal string is 'localhost'.

Related errors

• 5002
• ${cause.message}
• 5008
• 5014
• 5015

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/8a881841a954f8fc. Report an issue: GitHub.