justauth/JustAuth · error · AuthException

${error_description}

Error message

${error_description}

What it means

In AuthTaobaoRequest.getUserInfo, the raw token-endpoint response is parsed and, if it contains an `error` key, JustAuth throws AuthException carrying the `error_description` field verbatim (no numeric code). Note the quirk of this provider class: getUserInfo internally re-runs the code exchange (doPostAuthorizationCode) rather than using the passed token, so this error fires during the login/userInfo step against taobao's token endpoint.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthTaobaoRequest.java:56

    }

    private AuthToken getAuthToken(JSONObject object) {
        this.checkResponse(object);

        return AuthToken.builder()
            .accessToken(object.getString("access_token"))
            .expireIn(object.getIntValue("expires_in"))
            .tokenType(object.getString("token_type"))
            .idToken(object.getString("id_token"))
            .refreshToken(object.getString("refresh_token"))
            .uid(object.getString("taobao_user_id"))
            .openId(object.getString("taobao_open_uid"))
            .build();
    }

    private void checkResponse(JSONObject object) {
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("error_description"));
        }
    }

    @Override
    public AuthUser getUserInfo(AuthToken authToken) {
        String response = doPostAuthorizationCode(authToken.getAccessCode());
        JSONObject accessTokenObject = JSONObject.parseObject(response);
        if (accessTokenObject.containsKey("error")) {
            throw new AuthException(accessTokenObject.getString("error_description"));
        }
        authToken = this.getAuthToken(accessTokenObject);

        String nick = GlobalAuthUtils.urlDecode(accessTokenObject.getString("taobao_user_nick"));
        return AuthUser.builder()
            .rawUserInfo(accessTokenObject)
            .uuid(StringUtils.isEmpty(authToken.getUid()) ? authToken.getOpenId() : authToken.getUid())
            .username(nick)
            .nickname(nick)

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Read error_description: Taobao messages usually state the exact cause (e.g. 'invalid code', 'appkey not exist', 'redirect_uri mismatch').
2. Ensure the authorization code from the callback is used once and immediately — cache nothing across retries.
3. Verify app key/app secret and the callback URL registered in the Taobao open platform console match AuthConfig exactly.
4. Confirm your app has the required API scope granted (e.g. taobao.user.info) and is approved.

// validate callback shape before invoking Taobao flow
if (StringUtils.isEmpty(callback.getCode())) {
    throw new IllegalArgumentException("missing 'code' in Taobao callback");
}

try {
    AuthUser u = taobaoRequest.getUserInfo(token);
} catch (AuthException e) {
    log.warn("Taobao token exchange failed: {}", e.getMessage());
    // re-send user to authorization instead of looping
    redirect(taobaoRequest.authorize(newState()));
}

When it happens

Trigger: Calling getUserInfo on AuthTaobaoRequest when the token response contains an error: invalid/expired/reused authorization code, wrong appkey/appsecret, or redirect_uri not whitelisted in the Taobao open platform console.

Common situations: Taobao open-platform app credentials rotated; callback hitting getUserInfo twice (code already consumed); sandbox vs production environment mismatch; ISV app not yet published/scoped for the required API.

Related errors

• object.getString("error_description") / object.getString("er
• object.getString("msg")
• object.getString("error")
• JSONObject.toJSONString(response)
• data.getString("description")

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/21c9c248f454b4f0. Report an issue: GitHub.