justauth/JustAuth · error · UnsupportedOperationException

不支持获取授权 url，请使用小程序内置函数 wx.login() 登录获取 code

Error message

不支持获取授权 url，请使用小程序内置函数 wx.login() 登录获取 code

What it means

WECHAT_MINI_PROGRAM.authorize() throws UnsupportedOperationException with a Chinese message telling you to use the mini-program built-in wx.login() to obtain the code. WeChat mini programs have no web OAuth authorize URL: the code must come from the client-side wx.login() API, then be exchanged server-side via the jscode2session endpoint (this source's accessToken()).

Source

Thrown at src/main/java/me/zhyd/oauth/config/AuthDefaultSource.java:1447

        public String refresh() {
            return "https://www.figma.com/api/oauth/refresh";
        }

        @Override
        public Class<? extends AuthDefaultRequest> getTargetClass() {
            return AuthFigmaRequest.class;
        }
    },
    /**
     * 微信小程序授权登录
     * @since yudaocode
     */
    WECHAT_MINI_PROGRAM {

        @Override
        public String authorize() {
            // 参见 https://developers.weixin.qq.com/miniprogram/dev/framework/open-ability/login.html 文档
            throw new UnsupportedOperationException("不支持获取授权 url，请使用小程序内置函数 wx.login() 登录获取 code");
        }

        @Override
        public String accessToken() {
            // 参见 https://developers.weixin.qq.com/miniprogram/dev/api-backend/open-api/login/auth.code2Session.html 文档
            // 获取 openid, unionId , session_key 等字段
            return "https://api.weixin.qq.com/sns/jscode2session";
        }

        @Override
        public String userInfo() {
            // 参见 https://developers.weixin.qq.com/miniprogram/dev/api/open-api/user-info/wx.getUserProfile.html 文档
            throw new UnsupportedOperationException("不支持获取用户信息 url，请使用小程序内置函数 wx.getUserProfile() 获取用户信息");
        }

        @Override
        public Class<? extends AuthDefaultRequest> getTargetClass() {
            return AuthWechatMiniProgramRequest.class;

View on GitHub (pinned to 694bbf1b01)

Solutions

  1. For WECHAT_MINI_PROGRAM, call wx.login() inside the mini program client and POST the resulting code to your server, which calls getAccessToken(AuthCallback with code).
  2. Exclude mini-program sources from any authorize-URL generation flow (guard by source name/type).
  3. Catch UnsupportedOperationException in addition to AuthException around generic provider loops.

Example fix

// before
String url = request.authorize(state); // throws UnsupportedOperationException for WECHAT_MINI_PROGRAM

// after (mini-program client)
// wx.login({ success: r => POST /auth/wechat-mini?code=r.code })
// server:
AuthToken token = request.getAccessToken(AuthCallback.builder().code(code).build());
Defensive patterns

Strategy: validation

Validate before calling

if ("wechat_mini_program".equalsIgnoreCase(sourceName)) {
    // no authorize URL: client calls wx.login() and posts the code
    throw new ApiResponse("use wx.login() in the mini program client");
}

Type guard

boolean hasAuthorizeUrl(AuthSource s) {
    try { s.authorize(); return true; }
    catch (UnsupportedOperationException | AuthException e) { return false; }
}

Try / catch

catch (UnsupportedOperationException e) { /* mini-program source: switch to wx.login() + getAccessToken flow */ }

Prevention

When it happens

Trigger: Calling authorize(state) / getAuthorizeUrl(...) on a WECHAT_MINI_PROGRAM-backed request; rendering a generic 'login with X' redirect page for every configured source including the mini program one.

Common situations: A unified login endpoint that iterates all configured providers and calls getAuthorizeUrl for each; front-end code accidentally initializing the web OAuth flow for a mini-program integration; note UnsupportedOperationException is unchecked and not wrapped in AuthException, so generic AuthException handlers will miss it.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/f35840194ef9dad4. Report an issue: GitHub.