justauth/JustAuth · error · AuthException

5008

5008

Error message

Illegal code

What it means

AuthAlipayCertRequest.checkCode throws AuthException 5008 (Illegal code) when the callback carries no auth_code. Alipay's OAuth callback parameter is named auth_code (not code like most providers); if it is absent — wrong callback parsing, using the generic code field, or a manually constructed callback — the library rejects it before calling Alipay.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAlipayCertRequest.java:47

 * @since 1.16.7
 */
public class AuthAlipayCertRequest extends AuthDefaultRequest {

    private final AlipayClient alipayClient;

    public AuthAlipayCertRequest(AuthConfig config, AlipayConfig alipayConfig) {
        super(config, ALIPAY);
        try {
            this.alipayClient = new DefaultAlipayClient(alipayConfig);
        } catch (AlipayApiException e) {
            throw new AuthException(e);
        }
    }

    @Override
    protected void checkCode(AuthCallback authCallback) {
        if (StringUtils.isEmpty(authCallback.getAuth_code())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);
        }
    }

    @Override
    public AuthToken getAccessToken(AuthCallback authCallback) {
        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();
        request.setGrantType("authorization_code");
        request.setCode(authCallback.getAuth_code());
        AlipaySystemOauthTokenResponse response;
        try {
            response = this.alipayClient.certificateExecute(request);
        } catch (Exception e) {
            throw new AuthException(e);
        }
        if (!response.isSuccess()) {
            throw new AuthException(response.getSubMsg());
        }
        return AuthToken.builder()

View on GitHub (pinned to 694bbf1b01)

Solutions

1. In the Alipay callback handler, populate AuthCallback.auth_code from the auth_code request parameter (AuthCallback.builder().auth_code(request.getParameter("auth_code")) ...).
2. If your controller uses a generic mapper, special-case Alipay: also copy auth_code in addition to code.
3. Log raw query strings on OAuth callbacks so missing parameters are visible immediately.

Example fix

// before
AuthCallback cb = AuthCallback.builder().code(request.getParameter("code")).build(); // auth_code null -> 5008

// after
AuthCallback cb = AuthCallback.builder()
    .auth_code(request.getParameter("auth_code")) // Alipay sends auth_code
    .build();

String authCode = request.getParameter("auth_code");
if (StringUtils.isEmpty(authCode)) { throw new IllegalArgumentException("Alipay callback missing auth_code"); }
AuthCallback cb = AuthCallback.builder().auth_code(authCode).build();

try { return request.login(cb); } catch (AuthException e) { if (e.getErrcode() == AuthResponseStatus.ILLEGAL_CODE.getCode()) { return respond("missing auth_code, restart Alipay authorization"); } throw e; }

When it happens

Trigger: Building AuthCallback from a request where only 'code' was copied; Alipay redirecting with an error/empty auth_code (user denied or app misconfigured is_au=true scope); a callback mapping that drops query parameters.

Common situations: Generic callback controllers that read request.getParameter("code") for all providers and never populate auth_code for Alipay; URL-encoding or routing rules stripping query params; testing callbacks by hand without the auth_code parameter.

Related errors

• ${error_description}
• ${cause.message}
• ${subMsg}
• 5001
• 5003

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/4d48ef487c2a42d9. Report an issue: GitHub.