justauth/JustAuth · error · AuthException

object.getJSONObject("error").getString("message")

Error message

object.getJSONObject("error").getString("message")

What it means

AuthFacebookRequest.checkResponse() throws AuthException when the Facebook Graph API response contains an 'error' object; the exception message is error.message (e.g. 'Error validating access token'). It applies to token exchange, refresh, and user-info calls alike.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java:109

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        // facebook的回调地址必须为https的链接
        if (AuthDefaultSource.FACEBOOK == source && !GlobalAuthUtils.isHttpsProtocol(config.getRedirectUri())) {
            // Facebook's redirect uri must use the HTTPS protocol
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, source);
        }
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error")) {
            throw new AuthException(object.getJSONObject("error").getString("message"));
        }
    }

    /**
     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}
     *
     * @param state state 验证授权流程的参数，可以防止csrf
     * @return 返回授权地址
     */
    @Override
    public String authorize(String state) {
        return UrlBuilder.fromBaseUrl(super.authorize(state))
            .queryParam("scope", this.getScopes(",", false, AuthScopeUtils.getDefaultScopes(AuthFacebookScope.values())))
            .build();
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. Read error.message: 'access token has expired' -> call refresh(); 'user changed password' or 'not authorized' -> re-run the authorize flow.
  2. Switch the Facebook app to Live mode (or add test users) if user info fails only for non-admin accounts.
  3. Implement token refresh before every batch of Graph calls rather than after failure.
  4. Register a Deauthorize Callback URL in the Facebook console to drop local sessions when users remove the app.
Defensive patterns

Strategy: try-catch

Try / catch

try {
    return facebookRequest.getUserInfo(token);
} catch (AuthException e) {
    String m = String.valueOf(e.getErrorMsg());
    if (m.contains("expired")) {
        return facebookRequest.refresh(AuthToken.builder().refreshToken(refreshToken).build());
    }
    if (m.contains("changed the password") || m.contains("not authorized")) {
        return redirectToReauthorize();
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling any Facebook endpoint with an expired or invalidated access token, a user whose token was revoked (password change, app removal), or an app in development mode queried for a user not listed as a tester/admin.

Common situations: Access token passed its validity window without refresh; Facebook app still in development mode so Graph API hides most users; or long-lived token invalidated because the user changed their password.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/edab6e1f1cbcac45. Report an issue: GitHub.