justauth/JustAuth · error · AuthException

object.getString("error_description") / object.getString("er

Error message

object.getString("error_description") / object.getString("error_msg")

What it means

JustAuth's Baidu adapter throws AuthException from checkResponse() when the Baidu OAuth API answers with an 'error' or 'error_code' key instead of the expected token/user payload. The exception message is taken from 'error_description' (falling back to 'error_msg'), i.e. the text Baidu itself returns. This signals the token or userinfo HTTP call was rejected by Baidu, not a bug in your code.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthBaiduRequest.java:121

     * @since 1.9.3
     */
    @Override
    public String authorize(String state) {
        return UrlBuilder.fromBaseUrl(super.authorize(state))
            .queryParam("display", "popup")
            .queryParam("scope", this.getScopes(" ", true, AuthScopeUtils.getDefaultScopes(AuthBaiduScope.values())))
            .build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error") || object.containsKey("error_code")) {
            String msg = object.containsKey("error_description") ? object.getString("error_description") : object.getString("error_msg");
            throw new AuthException(msg);
        }
    }

    private AuthToken getAuthToken(String response) {
        JSONObject accessTokenObject = JSONObject.parseObject(response);
        this.checkResponse(accessTokenObject);
        return AuthToken.builder()
            .accessToken(accessTokenObject.getString("access_token"))
            .refreshToken(accessTokenObject.getString("refresh_token"))
            .scope(accessTokenObject.getString("scope"))
            .expireIn(accessTokenObject.getIntValue("expires_in"))
            .build();
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

Verify the Baidu client id (API Key) and client secret (Secret Key) in AuthConfig match the Baidu app console exactly.
Ensure the authorization code is used exactly once, immediately after the callback - re-calling login() with the same AuthCallback will fail.
Check config.redirectUri is byte-for-byte identical to the callback domain registered with Baidu.
Log the full AuthException message (Baidu's error_description) - it names the exact cause, e.g. 'invalid_grant' or 'expired token'.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    AuthResponse resp = baiduRequest.getUserInfo(token);
} catch (AuthException e) {
    log.warn("Baidu API error: {}", e.getErrorMsg());
    if (e.getErrorMsg() != null && e.getErrorMsg().contains("expired")) {
        return redirectToReauthorize(); // or refresh()
    }
    throw e;
}

Prevention

Store the refresh token at login and call refresh() before the access token's expireIn window closes.
Consume the authorization code exactly once; key callback handling on the state parameter to dedupe reloads.
Keep Baidu API Key/Secret Key in config management and alert on 'invalid_client' errors so rotated credentials are caught early.

When it happens

Trigger: Calling AuthBaiduRequest.getAccessToken()/refresh()/getUserInfo() with a wrong clientSecret, a reused or expired authorization code, a redirect_uri that does not match the one registered in Baidu's console, or an invalid/expired access_token when fetching user info.

Common situations: Copying the wrong API Key/Secret Key pair from the Baidu cloud console, reusing the 'code' query parameter after a redirect already consumed it, or testing locally with an http:// callback that differs from the registered redirect URI.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/41242af8b14a5c4d. Report an issue: GitHub.