justauth/JustAuth · error · AuthException

object.getString("msg")

Error message

object.getString("msg")

What it means

The CODING (AuthCodingRequest) adapter inspects every API response for a top-level numeric 'code' field; anything other than 0 means CODING rejected the request, and JustAuth throws AuthException carrying the 'msg' string from the same response body. It fires for both token exchange and user-info calls.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthCodingRequest.java:75

            .nickname(object.getString("name"))
            .company(object.getString("company"))
            .location(object.getString("location"))
            .gender(AuthUserGender.getRealGender(object.getString("sex")))
            .email(object.getString("email"))
            .remark(object.getString("slogan"))
            .token(authToken)
            .source(source.toString())
            .build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.getIntValue("code") != 0) {
            throw new AuthException(object.getString("msg"));
        }
    }

    /**
     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}
     *
     * @param state state 验证授权流程的参数，可以防止csrf
     * @return 返回授权地址
     * @since 1.9.3
     */
    @Override
    public String authorize(String state) {
        return UrlBuilder.fromBaseUrl(String.format(source.authorize(), config.getDomainPrefix()))
            .queryParam("response_type", "code")
            .queryParam("client_id", config.getClientId())
            .queryParam("redirect_uri", config.getRedirectUri())
            .queryParam("scope", this.getScopes(" ", true, AuthScopeUtils.getDefaultScopes(AuthCodingScope.values())))
            .queryParam("state", getRealState(state))

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Confirm clientId/clientSecret (and teamId if configured) are current in the CODING enterprise settings.
2. Guard against code replay: cache the state and consume the AuthCallback code on first use only.
3. If the token is expired, call refresh() with the stored refresh token instead of getUserInfo() with the stale access token.
4. Catch AuthException and surface e.getErrorMsg() - it is CODING's own 'msg' text describing the failure.

try {
    return codingRequest.getAccessToken(callback);
} catch (AuthException e) {
    log.warn("CODING error: {}", e.getErrorMsg());
    if (String.valueOf(e.getErrorMsg()).contains("invalid code")) {
        return AuthResponse.builder().code(AuthResponseStatus.FAILURE.getCode()).msg("authorization code consumed or expired").build();
    }
    throw e;
}

When it happens

Trigger: getAccessToken() or getUserInfo() on AuthCodingRequest when the CODING OAuth server returns code != 0 - wrong client secret, expired/redeemed code, or an access token that has been revoked or expired.

Common situations: Team/client credentials rotated in the CODING admin without updating AuthConfig, callback handler replaying an old code after a page refresh, or long-running sessions whose access token expired and no refreshToken workflow was implemented.

Related errors

• object.getString("error_description") / object.getString("er
• data.getString("description")
• object.getString("error")
• 5002
• JSONObject.toJSONString(response)

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/cf85e0a66aeb865a. Report an issue: GitHub.