justauth/JustAuth · error · AuthException

${error_description}

Error message

${error_description}

What it means

AuthWeiboRequest.getAccessToken manually exchanges the authorization code (POST /oauth2/access_token) and, if the parsed JSON contains an `error` key, throws AuthException with the `error_description` value (message-only, no code). Weibo returns errors in the OAuth error format on the token endpoint.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthWeiboRequest.java:40

 * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
 * @since 1.0.0
 */
public class AuthWeiboRequest extends AuthDefaultRequest {

    public AuthWeiboRequest(AuthConfig config) {
        super(config, AuthDefaultSource.WEIBO);
    }

    public AuthWeiboRequest(AuthConfig config, AuthStateCache authStateCache) {
        super(config, AuthDefaultSource.WEIBO, authStateCache);
    }

    @Override
    public AuthToken getAccessToken(AuthCallback authCallback) {
        String response = doPostAuthorizationCode(authCallback.getCode());
        JSONObject accessTokenObject = JSONObject.parseObject(response);
        if (accessTokenObject.containsKey("error")) {
            throw new AuthException(accessTokenObject.getString("error_description"));
        }
        return AuthToken.builder()
            .accessToken(accessTokenObject.getString("access_token"))
            .uid(accessTokenObject.getString("uid"))
            .openId(accessTokenObject.getString("uid"))
            .expireIn(accessTokenObject.getIntValue("expires_in"))
            .build();
    }

    @Override
    public AuthUser getUserInfo(AuthToken authToken) {
        String accessToken = authToken.getAccessToken();
        String uid = authToken.getUid();
        String oauthParam = String.format("uid=%s&access_token=%s", uid, accessToken);

        HttpHeader httpHeader = new HttpHeader();
        httpHeader.add("Authorization", "OAuth2 " + oauthParam);
        httpHeader.add("API-RemoteIP", IpUtils.getLocalIp());

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. Set the 授权回调页 (callback page) in open.weibo.com app settings to exactly the redirectUri in AuthConfig (full match including https and path).
  2. Ensure the code is exchanged exactly once — dedupe callbacks, disable automatic browser re-POST.
  3. Verify clientId=App Key, clientSecret=App Secret from the Weibo open platform console.
  4. Use an HTTPS redirect_uri; Weibo rejects plain HTTP callbacks for most apps.
Defensive patterns

Strategy: try-catch

Validate before calling

// assert config matches Weibo console before the flow starts
if (!config.getRedirectUri().startsWith("https://")) {
    throw new IllegalArgumentException("Weibo requires an HTTPS redirect_uri");
}

Try / catch

try {
    AuthToken t = weiboRequest.getAccessToken(callback);
} catch (AuthException e) {
    String m = String.valueOf(e.getMessage());
    if (m.contains("redirect_uri")) throw new ConfigurationException("Weibo callback page mismatch", e);
    if (m.contains("code")) redirect(weiboRequest.authorize(newState())); // expired/reused code
    else throw e;
}

Prevention

When it happens

Trigger: Weibo code exchange failing: expired or already-used authorization code, redirect_uri mismatch with the one registered on open.weibo.com, wrong client_id/client_secret (App Key/Secret), or the code issued for a different callback URL than configured.

Common situations: Weibo app's 授权回调页 not set or not matching AuthConfig.redirectUri exactly (protocol, host, path); double callback handling consuming the code twice; App Key/Secret regenerated after review process; Weibo enforcing HTTPS-only callbacks while config uses HTTP.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/c4034aa75c11716f. Report an issue: GitHub.