justauth/JustAuth · error · AuthException

${error_description}

Error message

${error_description}

What it means

AuthStackOverflowRequest.checkResponse throws AuthException with the raw `error_description` string whenever the Stack Exchange OAuth token/user response contains an `error` key. There is no numeric code; the message comes verbatim from Stack Exchange's error payload. It guards both the access-token exchange (POST /oauth/access_token) and the user-info call.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthStackOverflowRequest.java:102

     * @param state state 验证授权流程的参数，可以防止csrf
     * @return 返回授权地址
     * @since 1.9.3
     */
    @Override
    public String authorize(String state) {
        return UrlBuilder.fromBaseUrl(super.authorize(state))
            .queryParam("scope", this.getScopes(",", false, AuthScopeUtils.getDefaultScopes(AuthStackoverflowScope.values())))
            .build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("error_description"));
        }
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Compare the message with standard Stack Exchange OAuth errors: 'redirect_uri does not match' → fix redirectUri in AuthConfig to exactly the OAuth Domain registered on stackapps.com.
2. Ensure each authorization code is exchanged exactly once — guard your callback endpoint against duplicate invocations (browser retry, double-click).
3. Verify clientId ('Client Id') and clientSecret ('Client Secret') from your stackapps.com app page.
4. Exchange the code immediately after the callback; codes expire quickly.

Example fix

// before
AuthConfig.builder()
    .redirectUri("https://example.com/callback")
    ...
// registered OAuth Domain on stackapps.com is "https://www.example.com/callback"

// after — byte-for-byte identical redirect
AuthConfig.builder()
    .redirectUri("https://www.example.com/callback")
    ...

// dedupe callbacks: never exchange one code twice
String code = callback.getCode();
if (!codeCache.putIfAbsent(code, true)) { // already seen
    response.sendError(409, "authorization code already used");
    return;
}

try {
    AuthResponse<AuthUser> res = request.login(callback);
} catch (AuthException e) {
    log.warn("StackOverflow oauth failed: {}", e.getMessage());
    if (String.valueOf(e.getMessage()).contains("redirect_uri")) {
        throw new IllegalStateException("redirectUri mismatch with stackapps.com registration", e);
    }
    throw e;
}

When it happens

Trigger: Stack Exchange returns OAuth 2.0 style errors during getAccessToken or getUserInfo: expired/already-used authorization code, redirect_uri mismatch, bad client_secret, or an access token lacking the requested scope.

Common situations: redirectUri in AuthConfig differs from the one registered on stackapps.com (must match exactly, including trailing slash); reusing a code after a retry or double callback (a previous request consumed it); expired code (>5 min old or already exchanged); wrong client_id/secret after regenerating the app key.

Related errors

• ${error_description}
• object.getString("error_description")
• 5006
• jsonObject.getString("message")
• ${error_description}

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/7859b9ba807e790f. Report an issue: GitHub.