justauth/JustAuth · error · AuthException

5008

5008

Error message

Illegal code

What it means

AuthException with AuthResponseStatus.ILLEGAL_CODE (code 5008) thrown from AuthAlipayRequest.checkCode when authCallback.getAuth_code() is empty. Alipay returns the authorization code in a query/body parameter named auth_code (not the usual code), so JustAuth validates it explicitly before the token exchange.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java:145

    protected void check(AuthConfig config) {
        AuthChecker.checkConfig(config, AuthDefaultSource.ALIPAY);

        if (!StringUtils.isNotEmpty(alipayPublicKey)) {
            throw new AuthException(AuthResponseStatus.PARAMETER_INCOMPLETE, AuthDefaultSource.ALIPAY);
        }

        // 支付宝在创建回调地址时，不允许使用localhost或者127.0.0.1
        if (GlobalAuthUtils.isLocalHost(config.getRedirectUri())) {
            // The redirect uri of alipay is forbidden to use localhost or 127.0.0.1
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, AuthDefaultSource.ALIPAY);
        }
    }

    @Override
    protected void checkCode(AuthCallback authCallback) {
        if (StringUtils.isEmpty(authCallback.getAuth_code())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);
        }
    }

    @Override
    public AuthToken getAccessToken(AuthCallback authCallback) {
        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();
        request.setGrantType("authorization_code");
        request.setCode(authCallback.getAuth_code());
        AlipaySystemOauthTokenResponse response;
        try {
            response = this.alipayClient.execute(request);
        } catch (Exception e) {
            throw new AuthException(e);
        }
        if (!response.isSuccess()) {
            throw new AuthException(response.getSubMsg());
        }
        return AuthToken.builder()

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Inspect the raw callback query string — if auth_code is absent, check for Alipay error parameters (error, error_description) and surface those to the user
2. Make sure the redirect URI handling passes the full query string into AuthCallback
3. When testing, populate authCallback.auth_code (Alipay's parameter name), not code

Example fix

// before (test code)
AuthCallback cb = new AuthCallback();
cb.setCode("xyz");

// after
AuthCallback cb = new AuthCallback();
cb.setAuth_code("xyz");

if (StringUtils.isEmpty(callback.getAuth_code())) {
    String err = callback.getError(); // may explain why auth_code is absent
    // user denied or flow failed — do not call login()
    return redirectToAuthorize(ALIPAY).withFlash("auth_failed", err);
}

When it happens

Trigger: Calling login(authCallback) / getAccessToken(authCallback) where the callback from Alipay has no auth_code parameter — e.g. the user denied consent, Alipay redirected with an error, or the callback was parsed as a generic OAuth2 callback expecting code instead of auth_code.

Common situations: User clicked 'deny' on the Alipay consent page so Alipay redirects without auth_code; servlet mapping consumed the parameter; manually constructing AuthCallback for tests and setting code instead of auth_code.

Related errors

• ${errMsg}
• 5002
• 5006
• ${cause.message}
• ${subMsg}

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/263074efa0593c84. Report an issue: GitHub.