justauth/JustAuth · error · AuthException

${error}

Error message

${error}

What it means

AuthWeiboRequest.getUserInfo calls Weibo's user-show API with a hand-built OAuth2 header (uid + access_token) and throws AuthException(object.getString("error")) if the response JSON contains an `error` key. Unlike the token exchange (which uses error_description), the user endpoint's error field itself is the message. Note the local variableIp/IP header requirement — requests from non-whitelisted IPs also fail.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthWeiboRequest.java:63

            .openId(accessTokenObject.getString("uid"))
            .expireIn(accessTokenObject.getIntValue("expires_in"))
            .build();
    }

    @Override
    public AuthUser getUserInfo(AuthToken authToken) {
        String accessToken = authToken.getAccessToken();
        String uid = authToken.getUid();
        String oauthParam = String.format("uid=%s&access_token=%s", uid, accessToken);

        HttpHeader httpHeader = new HttpHeader();
        httpHeader.add("Authorization", "OAuth2 " + oauthParam);
        httpHeader.add("API-RemoteIP", IpUtils.getLocalIp());
        String userInfo = new HttpUtils(config.getHttpConfig())
            .get(userInfoUrl(authToken), null, httpHeader, false).getBody();
        JSONObject object = JSONObject.parseObject(userInfo);
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("error"));
        }
        return AuthUser.builder()
            .rawUserInfo(object)
            .uuid(object.getString("id"))
            .username(object.getString("name"))
            .avatar(object.getString("profile_image_url"))
            .blog(StringUtils.isEmpty(object.getString("url")) ? "https://weibo.com/" + object.getString("profile_url") : object
                .getString("url"))
            .nickname(object.getString("screen_name"))
            .location(object.getString("location"))
            .remark(object.getString("description"))
            .gender(AuthUserGender.getRealGender(object.getString("gender")))
            .token(authToken)
            .source(source.toString())
            .build();
    }

    /**

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. Read the error text: 'invalid access token'/'token expired' → discard the stored token and redirect the user to authorize(state) again.
  2. Confirm the app has 用户信息接口 (users/show) permission and passed review in the Weibo console.
  3. Throttle user-info calls and cache the AuthUser — Weibo rate-limits per token and per IP aggressively.
  4. Verify the uid stored in AuthToken came from the token-exchange response, not a stale record.
Defensive patterns

Strategy: try-catch

Validate before calling

// check token freshness and per-user rate budget before user-info call
if (token.getExpireTime() != null && System.currentTimeMillis() > token.getExpireTime()) {
    token = weiboRequest.refresh(token); // or re-authorize
}

Try / catch

try {
    AuthUser u = weiboRequest.getUserInfo(token);
} catch (AuthException e) {
    String m = String.valueOf(e.getMessage());
    if (m.contains("access token") || m.contains("expired")) {
        redirect(weiboRequest.authorize(state)); // user revoked or token expired
    } else throw e;
}

Prevention

When it happens

Trigger: User-info call after login with an expired/revoked access token (Weibo tokens expire or are revoked when the user cancels authorization), wrong uid in AuthToken, missing API permission for the app, or Weibo returning 'IP requests api get static out of rate limit' style errors.

Common situations: User revoked the app on Weibo but the app still holds the old token; app not approved for the user-show API scope; per-IP or per-user rate limits during batch imports; sandbox/unreviewed apps hitting friend-visible fields.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/f9f33d3d4d59889e. Report an issue: GitHub.