justauth/JustAuth · error · AuthException

object.getString("error")

Error message

object.getString("error")

What it means

AuthException thrown by AuthHuaweiV3Request.checkResponse when the Huawei account API response contains the 'NSP_STATUS' key, which Huawei uses to signal a server-side processing error. The exception message is the raw value of the response's 'error' field. It usually means the token/code exchange or user-info call was rejected by Huawei (invalid client secret, bad code, wrong app ID, expired authorization).

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthHuaweiV3Request.java:188

            String codeVerifier = PkceUtil.generateCodeVerifier();
            String codeChallengeMethod = "S256";
            String codeChallenge = PkceUtil.generateCodeChallenge(codeChallengeMethod, codeVerifier);
            builder.queryParam("code_challenge", codeChallenge)
                .queryParam("code_challenge_method", codeChallengeMethod);
            // 缓存 codeVerifier 十分钟
            this.authStateCache.cache(cacheKey, codeVerifier, TimeUnit.MINUTES.toMillis(10));
        }
        return builder.build();
    }

    /**
     * 校验响应结果
     *
     * @param object 接口返回的结果
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("NSP_STATUS")) {
            throw new AuthException(object.getString("error"));
        }
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("sub_error") + ":" + object.getString("error_description"));
        }
    }


}

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. Verify clientId/clientSecret match the Huawei AppGallery Connect app exactly (no trailing spaces)
  2. Confirm redirectUri is registered in the Huawei console and that the authorization code is fresh (codes are single-use and short-lived)
  3. Wrap the call in try-catch on AuthException and log the 'error' message; Huawei error codes (e.g. 10001, 10002) pinpoint the cause
  4. If behind a proxy, verify HttpConfig reaches Huawei's endpoints without a captive portal mangling the response

Example fix

// before
AuthToken token = authRequest.getAuthResponse(authCallback).getData();

// after
try {
    AuthToken token = authRequest.getAuthResponse(authCallback).getData();
} catch (AuthException e) {
    log.error("Huawei OAuth failed: {}", e.getMessage()); // message is Huawei's 'error' field
    throw e;
}
Defensive patterns

Strategy: try-catch

Validate before calling

null

Type guard

null

Try / catch

try {
    AuthResponse<AuthToken> resp = huaweiRequest.getAuthResponse(callback);
} catch (AuthException e) {
    // e.getMessage() is Huawei's raw 'error' value from the NSP_STATUS body
    log.warn("Huawei OAuth error: {}", e.getMessage());
    return redirect("/login?error=huawei");
}

Prevention

When it happens

Trigger: Calling getAccessToken/getUserInfo/revoke on an AuthHuaweiV3Request when Huawei responds with a JSON body containing NSP_STATUS (e.g. 10001 invalid grant, wrong appid/secret pair, or an already-consumed authorization code).

Common situations: Wrong Client Secret copied from AppGallery Console, App ID mismatch between config and the redirect URI whitelist, reusing a code after the redirect was processed twice, or the app being offline/unsynchronized in the console.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/72959af75acaa3b0. Report an issue: GitHub.