📝 编写文档

✅ 修改测试代码
📌 升级hutool版本
2026-05-22 21:53:18 +00:00 · 2019-06-29 15:12:49 +08:00 · 2019-06-29 07:36:08 +08:00 · 2019-06-28 23:08:09 +08:00 · 2019-06-28 22:58:34 +08:00 · 2019-06-28 21:33:49 +08:00
36 changed files with 550 additions and 323 deletions
@@ -6,7 +6,7 @@
 </p>
 <p align="center">
 	<a target="_blank" href="https://search.maven.org/search?q=JustAuth">
-		<img src="https://img.shields.io/badge/Maven Central-1.7.0-blue.svg" ></img>
+		<img src="https://img.shields.io/badge/Maven Central-1.8.0-blue.svg" ></img>
 	</a>
 	<a target="_blank" href="https://gitee.com/yadong.zhang/JustAuth/blob/master/LICENSE">
 		<img src="https://img.shields.io/apm/l/vim-mode.svg?color=yellow" ></img>
@@ -14,6 +14,9 @@
 	<a target="_blank" href="https://www.oracle.com/technetwork/java/javase/downloads/index.html">
 		<img src="https://img.shields.io/badge/JDK-1.8+-green.svg" ></img>
 	</a>
+	<a target="_blank" href="https://apidoc.gitee.com/yadong.zhang/JustAuth/">
+		<img src="https://img.shields.io/badge/Docs-1.8.0-orange.svg" ></img>
+	</a>
 </p>

 <center>
@@ -65,7 +68,7 @@ JustAuth，如你所见，它仅仅是一个**第三方授权登录**的**工具
 <dependency>
    <groupId>me.zhyd.oauth</groupId>
    <artifactId>JustAuth</artifactId>
-    <version>1.7.0</version>
+    <version>1.8.0</version>
 </dependency>
 ```
 - 调用api
@@ -78,10 +81,12 @@ AuthRequest authRequest = new AuthGiteeRequest(AuthConfig.builder()
        .build());
 // 生成授权页面
 authRequest.authorize();
-// 授权登录后会返回一个code，用这个code进行登录
-authRequest.login("code");
+// 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的参数
+authRequest.login(callback);
 ```

+注：`1.8.0`版本后，增加了`state`参数校验，用于防止[CSRF](https://zh.wikipedia.org/wiki/%E8%B7%A8%E7%AB%99%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0)。强烈建议，保证单次流程内`state`的唯一性，且每个`state`只可用一次。
+
 **配套Demo**：[JustAuth-demo](https://gitee.com/yadong.zhang/JustAuth-demo)

 具体的例子可以参考：
@@ -93,20 +98,20 @@ authRequest.login("code");
 |  :computer: 平台  |  :coffee: API类  |  :page_facing_up: SDK  |
 |:------:|:-------:|:-------:|
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/gitee.png" width="20">  |  [AuthGiteeRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  | <a href="https://gitee.com/api/v5/oauth_doc#list_1" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/github.png" width="20">  |  [AuthGithubRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://github.com/settings/developers" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/weibo.png" width="20">  |  [AuthWeiboRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://open.weibo.com/wiki/%E5%BE%AE%E5%8D%9AAPI" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/github.png" width="20">  |  [AuthGithubRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/" target="_blank">参考文档</a> |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/weibo.png" width="20">  |  [AuthWeiboRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://open.weibo.com/wiki/%E6%8E%88%E6%9D%83%E6%9C%BA%E5%88%B6%E8%AF%B4%E6%98%8E" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/dingtalk.png" width="20">  |  [AuthDingTalkRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthDingTalkRequest.java)  |  <a href="https://open-doc.dingtalk.com/microapp/serverapi2/kymkv6" target="_blank">参考文档</a>  |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/baidu.png" width="20">  |  [AuthBaiduRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthBaiduRequest.java)  |  <a href="https://developer.baidu.com/" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/baidu.png" width="20">  |  [AuthBaiduRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthBaiduRequest.java)  |  <a href="http://developer.baidu.com/wiki/index.php?title=docs/oauth" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/coding.png" width="25">  |  [AuthCodingRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthCodingRequest.java)  |  <a href="https://open.coding.net/references/oauth/" target="_blank">参考文档</a> |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/tencentCloud.png" width="25">  |  [AuthTencentCloudRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthTencentCloudRequest.java)  |  <a href="https://dev.tencent.com/help/doc/faq/b4e5b7aee786/oauth" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/oschina.png" width="20">  |  [AuthOschinaRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthOschinaRequest.java)  |  <a href="https://www.oschina.net/openapi/docs/openapi_user" target="_blank">参考文档</a> |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/oschina.png" width="20">  |  [AuthOschinaRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthOschinaRequest.java)  |  <a href="https://www.oschina.net/openapi/docs/oauth2_authorize" target="_blank">参考文档</a> |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/alipay.png" width="20">  |  [AuthAlipayRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java)  |  <a href="https://alipay.open.taobao.com/docs/doc.htm?spm=a219a.7629140.0.0.336d4b70GUKXOl&treeId=193&articleId=105809&docType=1" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/qq.png" width="20">  |  [AuthQqRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthQqRequest.java)  |  <a href="http://wiki.connect.qq.com/" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/qq.png" width="20">  |  [AuthQqRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthQqRequest.java)  |  <a href="https://wiki.connect.qq.com/%E4%BD%BF%E7%94%A8authorization_code%E8%8E%B7%E5%8F%96access_token" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/wechat.png" width="20">  |  [AuthWeChatRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthWeChatRequest.java)   |  <a href="https://open.weixin.qq.com/cgi-bin/showdocument?action=dir_list&t=resource/res_list&verify=1&id=open1419316505&token=&lang=zh_CN" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/taobao.png" width="20">  |  [AuthTaobaoRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthTaobaoRequest.java)   |  <a href="https://open.taobao.com/doc.htm?spm=a219a.7386797.0.0.4e00669acnkQy6&source=search&docId=105590&docType=1" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/google.png" width="20">  |  [AuthGoogleRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGoogleRequest.java)   |  <a href="https://developers.google.com/identity/protocols/OpenIDConnect" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/facebook.png" width="20">  |  [AuthFacebookRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java)   |  <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow" target="_blank">参考文档</a>  |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/douyin.png" width="20">  |  [AuthDouyinRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthDouyinRequest.java)   |  <a href="https://www.douyin.com/platform/doc" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/douyin.png" width="20">  |  [AuthDouyinRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthDouyinRequest.java)   |  <a href="https://www.douyin.com/platform/doc/m-2-1-1" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/linkedin.png" width="20">  |  [AuthLinkedinRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthLinkedinRequest.java)   |  <a href="https://docs.microsoft.com/zh-cn/linkedin/shared/authentication/authorization-code-flow?context=linkedin/context" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/microsoft.png" width="20">  | [AuthMicrosoftRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthMicrosoftRequest.java) | <a href="https://docs.microsoft.com/zh-cn/graph/auth/" target="_blank">参考文档</a> |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/mi.png" width="20">  | [AuthMiRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthMiRequest.java) | <a href="https://dev.mi.com/console/doc/detail?pId=711" target="_blank">参考文档</a> |
@@ -138,6 +143,10 @@ _请知悉：经咨询CSDN官方客服得知，CSDN的授权开放平台已经

 [阿里妈妈MUX倾力打造的矢量图标库-iconfont](https://www.iconfont.cn/search/index): 本文档中的图标大部分取自该平台

+## 关于OAuth
+
+[The OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749)
+
 ## 关注&交流

 |  公众号  |  微信(备注:加群)  |
@@ -6,7 +6,7 @@

    <groupId>me.zhyd.oauth</groupId>
    <artifactId>JustAuth</artifactId>
-    <version>1.7.0</version>
+    <version>1.8.0</version>

    <name>JustAuth</name>
    <url>https://gitee.com/yadong.zhang/JustAuth</url>
@@ -49,12 +49,10 @@
        <maven-source.version>2.2.1</maven-source.version>
        <maven-compiler.version>3.7.0</maven-compiler.version>
        <maven.test.skip>true</maven.test.skip>
-        <hutool-version>4.1.21</hutool-version>
+        <hutool-version>4.5.15</hutool-version>
        <lombok-version>1.18.4</lombok-version>
        <junit-version>4.11</junit-version>
        <fastjson-version>1.2.44</fastjson-version>
-        <google-api-version>1.28.0</google-api-version>
-        <guava-version>27.1-jre</guava-version>
        <alipay-sdk-version>3.7.4.ALL</alipay-sdk-version>
    </properties>

@@ -35,4 +35,20 @@ public class AuthConfig {
     * 支付宝公钥：当选择支付宝登录时，该值可用
     */
    private String alipayPublicKey;
+
+    /**
+     * 是否需要申请unionid，目前只针对qq登录
+     * 注：qq授权登录时，获取unionid需要单独发送邮件申请权限。如果个人开发者账号中申请了该权限，可以将该值置为true，在获取openId时就会同步获取unionId
+     * 参考链接：http://wiki.connect.qq.com/unionid%E4%BB%8B%E7%BB%8D
+     * <p>
+     * 1.7.1版本新增参数
+     */
+    private boolean unionId;
+
+    /**
+     * 一个神奇的参数，最好使用随机的不可测的内容，可以用来防止CSRF攻击
+     * <p>
+     * 1.8.0版本新增参数
+     */
+    private String state;
 }
@@ -327,7 +327,7 @@ public enum AuthSource {

        @Override
        public String refresh() {
-            return "https://open.douyin.com/oauth/refresh_token";
+            return "https://open.douyin.com/oauth/refresh_token/";
        }
    },
    /**
@@ -0,0 +1,31 @@
+package me.zhyd.oauth.model;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * 授权回调时的参数类
+ *
+ * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
+ * @version 1.0
+ * @since 1.8
+ */
+@Getter
+@Setter
+public class AuthCallback {
+
+    /**
+     * 访问AuthorizeUrl后回调时带的参数code
+     */
+    private String code;
+
+    /**
+     * 访问AuthorizeUrl后回调时带的参数auth_code，该参数目前只使用于支付宝登录
+     */
+    private String auth_code;
+
+    /**
+     * 访问AuthorizeUrl后回调时带的参数state，用于和请求AuthorizeUrl前的state比较，防止CSRF攻击
+     */
+    private String state;
+}
@@ -1,7 +1,8 @@
 package me.zhyd.oauth.model;

 import lombok.Builder;
-import lombok.Data;
+import lombok.Getter;
+import lombok.Setter;
 import me.zhyd.oauth.request.ResponseStatus;

 /**
@@ -11,8 +12,9 @@ import me.zhyd.oauth.request.ResponseStatus;
 * @version 1.0
 * @since 1.8
 */
+@Getter
+@Setter
@Builder
-@Data
 public class AuthResponse<T> {
    /**
     * 授权响应状态码
@@ -2,6 +2,8 @@ package me.zhyd.oauth.model;

 import lombok.Builder;
 import lombok.Data;
+import lombok.Getter;
+import lombok.Setter;

 /**
 * 授权所需的token
@@ -10,7 +12,8 @@ import lombok.Data;
 * @version 1.0
 * @since 1.8
 */
-@Data
+@Getter
+@Setter
@Builder
 public class AuthToken {
    private String accessToken;
@@ -2,6 +2,8 @@ package me.zhyd.oauth.model;

 import lombok.Builder;
 import lombok.Data;
+import lombok.Getter;
+import lombok.Setter;
 import me.zhyd.oauth.config.AuthSource;

 /**
@@ -11,9 +13,14 @@ import me.zhyd.oauth.config.AuthSource;
 * @version 1.0
 * @since 1.8
 */
+@Getter
+@Setter
@Builder
-@Data
 public class AuthUser {
+    /**
+     * 用户第三方系统的唯一id。在调用方集成改组件时，可以用uuid + source唯一确定一个用户
+     */
+    private String uuid;
    /**
     * 用户名
     */
@@ -58,8 +65,4 @@ public class AuthUser {
     * 用户授权的token信息
     */
    private AuthToken token;
-    /**
-     * 用户第三方系统的唯一id。在调用方集成改组件时，可以用uuid + source唯一确定一个用户
-     */
-    private String uuid;
 }
@@ -10,6 +10,7 @@ import com.alipay.api.response.AlipayUserInfoShareResponse;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -34,15 +35,15 @@ public class AuthAlipayRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();
        request.setGrantType("authorization_code");
-        request.setCode(code);
+        request.setCode(authCallback.getAuth_code());
        AlipaySystemOauthTokenResponse response = null;
        try {
            response = this.alipayClient.execute(request);
        } catch (Exception e) {
-            throw new AuthException("Unable to get token from alipay using code [" + code + "]", e);
+            throw new AuthException("Unable to get token from alipay using code [" + authCallback.getAuth_code() + "]", e);
        }
        if (!response.isSuccess()) {
            throw new AuthException(response.getSubMsg());
@@ -92,6 +93,6 @@ public class AuthAlipayRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getAlipayAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getAlipayAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -23,16 +23,21 @@ public class AuthBaiduRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getBaiduAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getBaiduAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                .getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
        AuthBaiduErrorCode errorCode = AuthBaiduErrorCode.getErrorCode(accessTokenObject.getString("error"));
-        if (!AuthBaiduErrorCode.OK.equals(errorCode)) {
+        if (AuthBaiduErrorCode.OK != errorCode) {
            throw new AuthException(errorCode.getDesc());
        }
-        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .scope(accessTokenObject.getString("scope"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .build();
    }

    @Override
@@ -42,7 +47,7 @@ public class AuthBaiduRequest extends BaseAuthRequest {
        String userInfo = response.body();
        JSONObject object = JSONObject.parseObject(userInfo);
        AuthBaiduErrorCode errorCode = AuthBaiduErrorCode.getErrorCode(object.getString("error"));
-        if (!AuthBaiduErrorCode.OK.equals(errorCode)) {
+        if (AuthBaiduErrorCode.OK != errorCode) {
            throw new AuthException(errorCode.getDesc());
        }
        return AuthUser.builder()
@@ -62,7 +67,7 @@ public class AuthBaiduRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getBaiduAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getBaiduAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    @Override
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,14 +26,18 @@ public class AuthCodingRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getCodingAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getCodingAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
        HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
        if (accessTokenObject.getIntValue("code") != 0) {
-            throw new AuthException("Unable to get token from coding using code [" + code + "]");
+            throw new AuthException("Unable to get token from coding using code [" + authCallback.getCode() + "]");
        }
-        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .build();
    }

    @Override
@@ -68,6 +73,6 @@ public class AuthCodingRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getCodingAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getCodingAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,13 +26,13 @@ public class AuthCsdnRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getCsdnAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getCsdnAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                .getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
        if (accessTokenObject.containsKey("error_code")) {
-            throw new AuthException("Unable to get token from csdn using code [" + code + "]");
+            throw new AuthException("Unable to get token from csdn using code [" + authCallback.getCode() + "]");
        }
        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
    }
@@ -62,6 +63,6 @@ public class AuthCsdnRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getCsdnAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getCsdnAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthDingTalkErrorCode;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.GlobalAuthUtil;
 import me.zhyd.oauth.utils.UrlBuilder;

@@ -28,8 +25,8 @@ public class AuthDingTalkRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        return AuthToken.builder().accessCode(code).build();
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        return AuthToken.builder().accessCode(authCallback.getCode()).build();
    }

    @Override
@@ -40,13 +37,12 @@ public class AuthDingTalkRequest extends BaseAuthRequest {
        String urlEncodeSignature = GlobalAuthUtil.generateDingTalkSignature(config.getClientSecret(), timestamp);
        JSONObject param = new JSONObject();
        param.put("tmp_auth_code", code);
-        HttpResponse response = HttpRequest.post(UrlBuilder.getDingTalkUserInfoUrl(urlEncodeSignature, timestamp, config.getClientId()))
-                .body(param.toJSONString())
-                .execute();
+        HttpResponse response = HttpRequest.post(UrlBuilder.getDingTalkUserInfoUrl(urlEncodeSignature, timestamp, config
+                .getClientId())).body(param.toJSONString()).execute();
        String userInfo = response.body();
        JSONObject object = JSON.parseObject(userInfo);
        AuthDingTalkErrorCode errorCode = AuthDingTalkErrorCode.getErrorCode(object.getIntValue("errcode"));
-        if (!AuthDingTalkErrorCode.EC0.equals(errorCode)) {
+        if (AuthDingTalkErrorCode.EC0 != errorCode) {
            throw new AuthException(errorCode.getDesc());
        }
        object = object.getJSONObject("user_info");
@@ -71,6 +67,6 @@ public class AuthDingTalkRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getDingTalkQrConnectUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getDingTalkQrConnectUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,10 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;


@@ -27,8 +24,8 @@ public class AuthDouyinRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getDouyinAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getDouyinAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
        return this.getToken(accessTokenUrl);
    }

@@ -61,7 +58,7 @@ public class AuthDouyinRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getDouyinAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getDouyinAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    @Override
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,20 +26,20 @@ public class AuthFacebookRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getFacebookAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getFacebookAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());

-        if (object.containsKey("error")) {
-            throw new AuthException(object.getJSONObject("error").getString("message"));
+        if (accessTokenObject.containsKey("error")) {
+            throw new AuthException(accessTokenObject.getJSONObject("error").getString("message"));
        }

        return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .tokenType(object.getString("token_type"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .tokenType(accessTokenObject.getString("token_type"))
                .build();
    }

@@ -79,6 +80,6 @@ public class AuthFacebookRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getFacebookAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getFacebookAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,13 +26,13 @@ public class AuthGiteeRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getGiteeAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getGiteeAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
        if (accessTokenObject.containsKey("error")) {
-            throw new AuthException("Unable to get token from gitee using code [" + code + "]");
+            throw new AuthException("Unable to get token from gitee using code [" + authCallback.getCode() + "]");
        }
        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
    }
@@ -65,6 +66,6 @@ public class AuthGiteeRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getGiteeAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getGiteeAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -28,9 +29,8 @@ public class AuthGithubRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getGithubAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getGithubAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config.getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
        Map<String, String> res = GlobalAuthUtil.parseStringToMap(response.body());
        if (res.containsKey("error")) {
@@ -68,6 +68,6 @@ public class AuthGithubRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getGithubAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getGithubAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,23 +26,23 @@ public class AuthGoogleRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getGoogleAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getGoogleAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                .getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());

-        if (object.containsKey("error") || object.containsKey("error_description")) {
-            throw new AuthException("get google access_token has error:[" + object.getString("error") + "], error_description:[" + object
+        if (accessTokenObject.containsKey("error") || accessTokenObject.containsKey("error_description")) {
+            throw new AuthException("get google access_token has error:[" + accessTokenObject.getString("error") + "], error_description:[" + accessTokenObject
                    .getString("error_description") + "]");
        }

        return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .scope(object.getString("scope"))
-                .tokenType(object.getString("token_type"))
-                .idToken(object.getString("id_token"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .scope(accessTokenObject.getString("scope"))
+                .tokenType(accessTokenObject.getString("token_type"))
+                .idToken(accessTokenObject.getString("id_token"))
                .build();
    }

@@ -71,6 +72,6 @@ public class AuthGoogleRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getGoogleAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getGoogleAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.StringUtils;
 import me.zhyd.oauth.utils.UrlBuilder;

@@ -29,8 +26,8 @@ public class AuthLinkedinRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getLinkedinAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getLinkedinAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                .getRedirectUri());
        return this.getToken(accessTokenUrl);
    }
@@ -96,7 +93,7 @@ public class AuthLinkedinRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getLinkedinAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getLinkedinAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    private String getUserEmail(String accessToken) {
@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;

 import java.text.MessageFormat;
@@ -30,29 +27,29 @@ public class AuthMiRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getMiAccessTokenUrl(config.getClientId(), config.getClientSecret(), config.getRedirectUri(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getMiAccessTokenUrl(config.getClientId(), config.getClientSecret(), config.getRedirectUri(), authCallback.getCode());
        return getToken(accessTokenUrl);
    }

    private AuthToken getToken(String accessTokenUrl) {
        HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
        String jsonStr = StrUtil.replace(response.body(), PREFIX, StrUtil.EMPTY);
-        JSONObject object = JSONObject.parseObject(jsonStr);
+        JSONObject accessTokenObject = JSONObject.parseObject(jsonStr);

-        if (object.containsKey("error")) {
-            throw new AuthException(object.getString("error_description"));
+        if (accessTokenObject.containsKey("error")) {
+            throw new AuthException(accessTokenObject.getString("error_description"));
        }

        return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .scope(object.getString("scope"))
-                .tokenType(object.getString("token_type"))
-                .refreshToken(object.getString("refresh_token"))
-                .openId(object.getString("openId"))
-                .macAlgorithm(object.getString("mac_algorithm"))
-                .macKey(object.getString("mac_key"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .scope(accessTokenObject.getString("scope"))
+                .tokenType(accessTokenObject.getString("token_type"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .openId(accessTokenObject.getString("openId"))
+                .macAlgorithm(accessTokenObject.getString("mac_algorithm"))
+                .macKey(accessTokenObject.getString("mac_key"))
                .build();
    }

@@ -63,7 +60,7 @@ public class AuthMiRequest extends BaseAuthRequest {
                .execute();

        JSONObject userProfile = JSONObject.parseObject(userResponse.body());
-        if (StrUtil.equalsIgnoreCase(userProfile.getString("result"), "error")) {
+        if ("error".equalsIgnoreCase(userProfile.getString("result"))) {
            throw new AuthException(userProfile.getString("description"));
        }

@@ -86,7 +83,7 @@ public class AuthMiRequest extends BaseAuthRequest {

        HttpResponse emailResponse = HttpRequest.get(emailPhoneUrl).execute();
        JSONObject userEmailPhone = JSONObject.parseObject(emailResponse.body());
-        if (!StrUtil.equalsIgnoreCase(userEmailPhone.getString("result"), "error")) {
+        if (!"error".equalsIgnoreCase(userEmailPhone.getString("result"))) {
            JSONObject emailPhone = userEmailPhone.getJSONObject("data");
            authUser.setEmail(emailPhone.getString("email"));
        }
@@ -101,7 +98,7 @@ public class AuthMiRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getMiAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getMiAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    /**
@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;

 import java.util.HashMap;
@@ -29,9 +26,9 @@ public class AuthMicrosoftRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
        String accessTokenUrl = UrlBuilder.getMicrosoftAccessTokenUrl(config.getClientId(), config.getClientSecret(), config
-                .getRedirectUri(), code);
+                .getRedirectUri(), authCallback.getCode());

        return getToken(accessTokenUrl);
    }
@@ -51,16 +48,16 @@ public class AuthMicrosoftRequest extends BaseAuthRequest {
                .form(paramMap)
                .execute();
        String accessTokenStr = response.body();
-        JSONObject object = JSONObject.parseObject(accessTokenStr);
+        JSONObject accessTokenObject = JSONObject.parseObject(accessTokenStr);

-        this.checkResponse(object);
+        this.checkResponse(accessTokenObject);

        return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .scope(object.getString("scope"))
-                .tokenType(object.getString("token_type"))
-                .refreshToken(object.getString("refresh_token"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .scope(accessTokenObject.getString("scope"))
+                .tokenType(accessTokenObject.getString("token_type"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
                .build();
    }

@@ -99,7 +96,7 @@ public class AuthMicrosoftRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getMicrosoftAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getMicrosoftAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    /**
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,15 +26,20 @@ public class AuthOschinaRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getOschinaAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getOschinaAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
        if (accessTokenObject.containsKey("error")) {
-            throw new AuthException("Unable to get token from oschina using code [" + code + "]");
+            throw new AuthException("Unable to get token from oschina using code [" + authCallback.getCode() + "]");
        }
-        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .uid(accessTokenObject.getString("uid"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .build();
    }

    @Override
@@ -65,6 +71,6 @@ public class AuthOschinaRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getOschinaAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getOschinaAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -7,6 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -30,13 +31,13 @@ public class AuthQqRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getQqAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getQqAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
        HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
        Map<String, String> accessTokenObject = GlobalAuthUtil.parseStringToMap(response.body());
        if (!accessTokenObject.containsKey("access_token")) {
-            throw new AuthException("Unable to get token from qq using code [" + code + "]");
+            throw new AuthException("Unable to get token from qq using code [" + authCallback.getCode() + "]");
        }
        return AuthToken.builder()
                .accessToken(accessTokenObject.get("access_token"))
@@ -80,12 +81,12 @@ public class AuthQqRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getQqAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getQqAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    private String getOpenId(AuthToken authToken) {
        String accessToken = authToken.getAccessToken();
-        HttpResponse response = HttpRequest.get(UrlBuilder.getQqOpenidUrl("https://graph.qq.com/oauth2.0/me", accessToken))
+        HttpResponse response = HttpRequest.get(UrlBuilder.getQqOpenidUrl("https://graph.qq.com/oauth2.0/me", accessToken, config.isUnionId()))
                .execute();
        if (response.isOk()) {
            String body = response.body();
@@ -97,7 +98,9 @@ public class AuthQqRequest extends BaseAuthRequest {
                throw new AuthException(object.get("error") + ":" + object.get("error_description"));
            }
            authToken.setOpenId(object.getString("openid"));
-            authToken.setUnionId(object.getString("unionid"));
+            if (object.containsKey("unionid")) {
+                authToken.setUnionId(object.getString("unionid"));
+            }
            return StringUtils.isEmpty(authToken.getUnionId()) ? authToken.getOpenId() : authToken.getUnionId();
        }

@@ -1,6 +1,7 @@
 package me.zhyd.oauth.request;

 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthResponse;
 import me.zhyd.oauth.model.AuthToken;

@@ -23,10 +24,10 @@ public interface AuthRequest {
    /**
     * 第三方登录
     *
-     * @param code 通过authorize换回的code
+     * @param authCallback 用于接收回调参数的实体
     * @return 返回登录成功后的用户信息
     */
-    default AuthResponse login(String code) {
+    default AuthResponse login(AuthCallback authCallback) {
        throw new AuthException(ResponseStatus.NOT_IMPLEMENTED);
    }

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -26,8 +27,8 @@ public class AuthTaobaoRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        return AuthToken.builder().accessCode(code).build();
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        return AuthToken.builder().accessCode(authCallback.getCode()).build();
    }

    @Override
@@ -35,19 +36,19 @@ public class AuthTaobaoRequest extends BaseAuthRequest {
        String accessCode = authToken.getAccessCode();
        HttpResponse response = HttpRequest.post(UrlBuilder.getTaobaoAccessTokenUrl(this.config.getClientId(), this.config
                .getClientSecret(), accessCode, this.config.getRedirectUri())).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
-        if (object.containsKey("error")) {
-            throw new AuthException(ResponseStatus.FAILURE + ":" + object.getString("error_description"));
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
+        if (accessTokenObject.containsKey("error")) {
+            throw new AuthException(ResponseStatus.FAILURE + ":" + accessTokenObject.getString("error_description"));
        }
-        authToken.setAccessToken(object.getString("access_token"));
-        authToken.setRefreshToken(object.getString("refresh_token"));
-        authToken.setExpireIn(object.getIntValue("expires_in"));
-        authToken.setUid(object.getString("taobao_user_id"));
-        authToken.setOpenId(object.getString("taobao_open_uid"));
+        authToken.setAccessToken(accessTokenObject.getString("access_token"));
+        authToken.setRefreshToken(accessTokenObject.getString("refresh_token"));
+        authToken.setExpireIn(accessTokenObject.getIntValue("expires_in"));
+        authToken.setUid(accessTokenObject.getString("taobao_user_id"));
+        authToken.setOpenId(accessTokenObject.getString("taobao_open_uid"));

-        String nick = GlobalAuthUtil.urlDecode(object.getString("taobao_user_nick"));
+        String nick = GlobalAuthUtil.urlDecode(accessTokenObject.getString("taobao_user_nick"));
        return AuthUser.builder()
-                .uuid(object.getString("taobao_user_id"))
+                .uuid(accessTokenObject.getString("taobao_user_id"))
                .username(nick)
                .nickname(nick)
                .gender(AuthUserGender.UNKNOW)
@@ -63,6 +64,6 @@ public class AuthTaobaoRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getTaobaoAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getTaobaoAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,14 +26,18 @@ public class AuthTencentCloudRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getTencentCloudAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getTencentCloudAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
        HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
-        if (object.getIntValue("code") != 0) {
-            throw new AuthException("Unable to get token from tencent cloud using code [" + code + "]: " + object.get("msg"));
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
+        if (accessTokenObject.getIntValue("code") != 0) {
+            throw new AuthException("Unable to get token from tencent cloud using code [" + authCallback.getCode() + "]: " + accessTokenObject.get("msg"));
        }
-        return AuthToken.builder().accessToken(object.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .build();
    }

    @Override
@@ -67,6 +72,6 @@ public class AuthTencentCloudRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getTencentCloudAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getTencentCloudAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,10 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthToutiaoErrorCode;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;

 /**
@@ -26,19 +23,19 @@ public class AuthToutiaoRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getToutiaoAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getToutiaoAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
        HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());

-        if (object.containsKey("error_code")) {
-            throw new AuthException(AuthToutiaoErrorCode.getErrorCode(object.getIntValue("error_code")).getDesc());
+        if (accessTokenObject.containsKey("error_code")) {
+            throw new AuthException(AuthToutiaoErrorCode.getErrorCode(accessTokenObject.getIntValue("error_code")).getDesc());
        }

        return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .openId(object.getString("open_id"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .openId(accessTokenObject.getString("open_id"))
                .build();
    }

@@ -76,6 +73,6 @@ public class AuthToutiaoRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getToutiaoAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getToutiaoAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -6,10 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;

 /**
@@ -27,12 +24,12 @@ public class AuthWeChatRequest extends BaseAuthRequest {
    /**
     * 微信的特殊性，此时返回的信息同时包含 openid 和 access_token
     *
-     * @param code 授权码
+     * @param authCallback 回调返回的参数
     * @return 所有信息
     */
    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getWeChatAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getWeChatAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
        return this.getToken(accessTokenUrl);
    }

@@ -66,7 +63,7 @@ public class AuthWeChatRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getWeChatAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getWeChatAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }

    @Override
@@ -97,15 +94,15 @@ public class AuthWeChatRequest extends BaseAuthRequest {
     */
    private AuthToken getToken(String accessTokenUrl) {
        HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());

-        this.checkResponse(object);
+        this.checkResponse(accessTokenObject);

        return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .refreshToken(object.getString("refresh_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .openId(object.getString("openid"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .openId(accessTokenObject.getString("openid"))
                .build();
    }
 }
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -28,19 +29,20 @@ public class AuthWeiboRequest extends BaseAuthRequest {
    }

    @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getWeiboAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getWeiboAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                .getRedirectUri());
        HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
        String accessTokenStr = response.body();
        JSONObject accessTokenObject = JSONObject.parseObject(accessTokenStr);
        if (accessTokenObject.containsKey("error")) {
-            throw new AuthException("Unable to get token from weibo using code [" + code + "]:" + accessTokenObject.getString("error_description"));
+            throw new AuthException("Unable to get token from weibo using code [" + authCallback.getCode() + "]:" + accessTokenObject.getString("error_description"));
        }
        return AuthToken.builder()
                .accessToken(accessTokenObject.getString("access_token"))
                .uid(accessTokenObject.getString("uid"))
-                .expireIn(accessTokenObject.getIntValue("remind_in"))
+                .openId(accessTokenObject.getString("uid"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
                .build();
    }

@@ -80,6 +82,6 @@ public class AuthWeiboRequest extends BaseAuthRequest {
     */
    @Override
    public String authorize() {
-        return UrlBuilder.getWeiboAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getWeiboAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
    }
 }
@@ -4,10 +4,11 @@ import lombok.Data;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthResponse;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.utils.AuthConfigChecker;
+import me.zhyd.oauth.utils.AuthChecker;

 /**
 * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
@@ -22,21 +23,24 @@ public abstract class BaseAuthRequest implements AuthRequest {
    public BaseAuthRequest(AuthConfig config, AuthSource source) {
        this.config = config;
        this.source = source;
-        if (!AuthConfigChecker.isSupportedAuth(config, source)) {
+        if (!AuthChecker.isSupportedAuth(config, source)) {
            throw new AuthException(ResponseStatus.PARAMETER_INCOMPLETE);
        }
        // 校验配置合法性
-        AuthConfigChecker.check(config, source);
+        AuthChecker.checkConfig(config, source);
    }

-    protected abstract AuthToken getAccessToken(String code);
+    protected abstract AuthToken getAccessToken(AuthCallback authCallback);

    protected abstract AuthUser getUserInfo(AuthToken authToken);

    @Override
-    public AuthResponse login(String code) {
+    public AuthResponse login(AuthCallback authCallback) {
        try {
-            AuthToken authToken = this.getAccessToken(code);
+            AuthChecker.checkCode(source == AuthSource.ALIPAY ? authCallback.getAuth_code() : authCallback.getCode());
+            AuthChecker.checkState(authCallback.getState(), config.getState());
+
+            AuthToken authToken = this.getAccessToken(authCallback);
            AuthUser user = this.getUserInfo(authToken);
            return AuthResponse.builder().code(ResponseStatus.SUCCESS.getCode()).data(user).build();
        } catch (Exception e) {
@@ -14,6 +14,8 @@ public enum ResponseStatus {
    NO_AUTH_SOURCE(5004, "AuthSource cannot be null"),
    UNIDENTIFIED_PLATFORM(5005, "Unidentified platform"),
    ILLEGAL_REDIRECT_URI(5006, "Illegal redirect uri"),
+    ILLEGAL_REQUEST(5007, "Illegal request"),
+    ILLEGAL_CODE(5008, "Illegal code"),
    ;

    private int code;
@@ -12,7 +12,7 @@ import me.zhyd.oauth.request.ResponseStatus;
 * @version 1.0
 * @since 1.8
 */
-public class AuthConfigChecker {
+public class AuthChecker {

    /**
     * 是否支持第三方登录
@@ -35,7 +35,7 @@ public class AuthConfigChecker {
     * @param config config
     * @param source source
     */
-    public static void check(AuthConfig config, AuthSource source) {
+    public static void checkConfig(AuthConfig config, AuthSource source) {
        String redirectUri = config.getRedirectUri();
        if (!GlobalAuthUtil.isHttpProtocol(redirectUri) && !GlobalAuthUtil.isHttpsProtocol(redirectUri)) {
            throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
@@ -49,4 +49,36 @@ public class AuthConfigChecker {
            throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
        }
    }
+
+    /**
+     * 校验回调传回的code
+     *
+     * @param code 回调时传回的code
+     */
+    public static void checkCode(String code) {
+        if (StringUtils.isEmpty(code)) {
+            throw new AuthException(ResponseStatus.ILLEGAL_CODE);
+        }
+    }
+
+    /**
+     * 校验state的合法性防止被CSRF
+     *
+     * @param newState      新的state，一般为回调时传回的state（可能被篡改）
+     * @param originalState 原始的state，发起授权时向第三方平台传递的state
+     */
+    public static void checkState(String newState, String originalState) {
+        // 如果原始state为空，表示当前平台未使用state
+        if (StringUtils.isEmpty(originalState)) {
+            return;
+        }
+        // 如果授权之前使用了state，但是回调时未返回state，则表示当前请求为非法的请求，可能正在被CSRF攻击
+        if (StringUtils.isEmpty(newState)) {
+            throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
+        }
+        // 如果授权前后的state不一致，则表示当前请求为非法的请求，新的state可能为伪造
+        if (!newState.equals(originalState)) {
+            throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
+        }
+    }
 }
@@ -8,6 +8,8 @@ import javax.crypto.spec.SecretKeySpec;
 import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
 import java.net.URLEncoder;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
@@ -22,16 +24,12 @@ import java.util.Map;
 * @since 1.8
 */
 public class GlobalAuthUtil {
-    private static final String DEFAULT_ENCODING = "UTF-8";
+    private static final Charset DEFAULT_ENCODING = StandardCharsets.UTF_8;
    private static final String ALGORITHM = "HmacSHA256";

    public static String generateDingTalkSignature(String secretKey, String timestamp) {
-        try {
-            byte[] signData = sign(secretKey.getBytes(DEFAULT_ENCODING), timestamp.getBytes(DEFAULT_ENCODING));
-            return urlEncode(new String(Base64.encode(signData, false)));
-        } catch (UnsupportedEncodingException ex) {
-            throw new AuthException("Unsupported algorithm: " + DEFAULT_ENCODING, ex);
-        }
+        byte[] signData = sign(secretKey.getBytes(DEFAULT_ENCODING), timestamp.getBytes(DEFAULT_ENCODING));
+        return urlEncode(new String(Base64.encode(signData, false)));
    }

    private static byte[] sign(byte[] key, byte[] data) {
@@ -52,9 +50,8 @@ public class GlobalAuthUtil {
        }

        try {
-            String encoded = URLEncoder.encode(value, GlobalAuthUtil.DEFAULT_ENCODING);
-            return encoded.replace("+", "%20").replace("*", "%2A")
-                    .replace("~", "%7E").replace("/", "%2F");
+            String encoded = URLEncoder.encode(value, GlobalAuthUtil.DEFAULT_ENCODING.displayName());
+            return encoded.replace("+", "%20").replace("*", "%2A").replace("~", "%7E").replace("/", "%2F");
        } catch (UnsupportedEncodingException e) {
            throw new AuthException("Failed To Encode Uri", e);
        }
@@ -65,7 +62,7 @@ public class GlobalAuthUtil {
            return "";
        }
        try {
-            return URLDecoder.decode(value, GlobalAuthUtil.DEFAULT_ENCODING);
+            return URLDecoder.decode(value, GlobalAuthUtil.DEFAULT_ENCODING.displayName());
        } catch (UnsupportedEncodingException e) {
            throw new AuthException("Failed To Decode Uri", e);
        }
@@ -15,7 +15,7 @@ public class UrlBuilder {

    private static final String GITHUB_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&code={3}&redirect_uri={4}";
    private static final String GITHUB_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String GITHUB_AUTHORIZE_PATTERN = "{0}?client_id={1}&state=1&redirect_uri={2}";
+    private static final String GITHUB_AUTHORIZE_PATTERN = "{0}?client_id={1}&redirect_uri={2}&state={3}";

    private static final String GOOGLE_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&scope=openid%20email%20profile&redirect_uri={2}&state={3}";
    private static final String GOOGLE_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&code={3}&redirect_uri={4}&grant_type=authorization_code";
@@ -23,42 +23,42 @@ public class UrlBuilder {

    private static final String WEIBO_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
    private static final String WEIBO_USER_INFO_PATTERN = "{0}?{1}";
-    private static final String WEIBO_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String WEIBO_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";

    private static final String GITEE_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
    private static final String GITEE_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String GITEE_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String GITEE_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";

-    private static final String DING_TALK_QRCONNECT_PATTERN = "{0}?appid={1}&response_type=code&scope=snsapi_login&state=STATE&redirect_uri={2}";
+    private static final String DING_TALK_QRCONNECT_PATTERN = "{0}?appid={1}&response_type=code&scope=snsapi_login&redirect_uri={2}&state={3}";
    private static final String DING_TALK_USER_INFO_PATTERN = "{0}?signature={1}&timestamp={2}&accessKey={3}";

    private static final String BAIDU_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
    private static final String BAIDU_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String BAIDU_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&display=popup";
+    private static final String BAIDU_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&display=popup&state={3}";
    private static final String BAIDU_REVOKE_PATTERN = "{0}?access_token={1}";

    private static final String CSDN_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
    private static final String CSDN_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String CSDN_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String CSDN_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";

    private static final String CODING_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}";
    private static final String CODING_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String CODING_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user";
+    private static final String CODING_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user&state={3}";

    private static final String TENCENT_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}";
    private static final String TENCENT_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String TENCENT_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user";
+    private static final String TENCENT_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user&state={3}";

    private static final String OSCHINA_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}&dataType=json";
    private static final String OSCHINA_USER_INFO_PATTERN = "{0}?access_token={1}&dataType=json";
-    private static final String OSCHINA_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String OSCHINA_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";

-    private static final String ALIPAY_AUTHORIZE_PATTERN = "{0}?app_id={1}&scope=auth_user&redirect_uri={2}&state=init";
+    private static final String ALIPAY_AUTHORIZE_PATTERN = "{0}?app_id={1}&scope=auth_user&redirect_uri={2}&state={3}";

    private static final String QQ_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
    private static final String QQ_USER_INFO_PATTERN = "{0}?oauth_consumer_key={1}&access_token={2}&openid={3}";
    private static final String QQ_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";
-    private static final String QQ_OPENID_PATTERN = "{0}?access_token={1}&unionid=1";
+    private static final String QQ_OPENID_PATTERN = "{0}?access_token={1}&unionid={2}";

    private static final String WECHAT_AUTHORIZE_PATTERN = "{0}?appid={1}&redirect_uri={2}&response_type=code&scope=snsapi_login&state={3}#wechat_redirect";
    private static final String WECHAT_ACCESS_TOKEN_PATTERN = "{0}?appid={1}&secret={2}&code={3}&grant_type=authorization_code";
@@ -87,7 +87,7 @@ public class UrlBuilder {
    private static final String MICROSOFT_USER_INFO_PATTERN = "{0}";
    private static final String MICROSOFT_REFRESH_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&scope=user.read%20mail.read&redirect_uri={3}&refresh_token={4}&grant_type=refresh_token";

-    private static final String MI_AUTHORIZE_PATTERN = "{0}?client_id={1}&redirect_uri={2}&response_type=code&scope=user/profile%20user/openIdV2%20user/phoneAndEmail&state={3}&skip_confirm=false";
+    private static final String MI_AUTHORIZE_PATTERN = "{0}?client_id={1}&redirect_uri={2}&response_type=code&scope=1%203%204%206&state={3}&skip_confirm=false";
    private static final String MI_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&redirect_uri={3}&code={4}&grant_type=authorization_code";
    private static final String MI_USER_INFO_PATTERN = "{0}?clientId={1}&token={2}";
    private static final String MI_REFRESH_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&redirect_uri={3}&refresh_token={4}&grant_type=refresh_token";
@@ -96,6 +96,15 @@ public class UrlBuilder {
    private static final String TOUTIAO_USER_INFO_PATTERN = "{0}?client_key={1}&access_token={2}";
    private static final String TOUTIAO_AUTHORIZE_PATTERN = "{0}?client_key={1}&redirect_uri={2}&state={3}&response_type=code&auth_only=1&display=0";

+    /**
+     * 获取state，如果为空， 则默认去当前日期的时间戳
+     *
+     * @param state state
+     */
+    private static Object getState(String state) {
+        return StringUtils.isEmpty(state) ? String.valueOf(System.currentTimeMillis()) : state;
+    }
+
    /**
     * 获取githubtoken的接口地址
     *
@@ -124,10 +133,11 @@ public class UrlBuilder {
     *
     * @param clientId    github 应用的Client ID
     * @param redirectUrl github 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getGithubAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(GITHUB_AUTHORIZE_PATTERN, AuthSource.GITHUB.authorize(), clientId, redirectUrl);
+    public static String getGithubAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(GITHUB_AUTHORIZE_PATTERN, AuthSource.GITHUB.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -158,10 +168,11 @@ public class UrlBuilder {
     *
     * @param clientId    weibo 应用的Client ID
     * @param redirectUrl weibo 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getWeiboAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(WEIBO_AUTHORIZE_PATTERN, AuthSource.WEIBO.authorize(), clientId, redirectUrl);
+    public static String getWeiboAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(WEIBO_AUTHORIZE_PATTERN, AuthSource.WEIBO.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -192,10 +203,11 @@ public class UrlBuilder {
     *
     * @param clientId    gitee 应用的Client ID
     * @param redirectUrl gitee 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return json
     */
-    public static String getGiteeAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(GITEE_AUTHORIZE_PATTERN, AuthSource.GITEE.authorize(), clientId, redirectUrl);
+    public static String getGiteeAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(GITEE_AUTHORIZE_PATTERN, AuthSource.GITEE.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -203,10 +215,11 @@ public class UrlBuilder {
     *
     * @param clientId    钉钉 应用的App Id
     * @param redirectUrl 钉钉 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getDingTalkQrConnectUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(DING_TALK_QRCONNECT_PATTERN, AuthSource.DINGTALK.authorize(), clientId, redirectUrl);
+    public static String getDingTalkQrConnectUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(DING_TALK_QRCONNECT_PATTERN, AuthSource.DINGTALK.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -249,10 +262,11 @@ public class UrlBuilder {
     *
     * @param clientId    baidu 应用的API Key
     * @param redirectUrl baidu 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return json
     */
-    public static String getBaiduAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(BAIDU_AUTHORIZE_PATTERN, AuthSource.BAIDU.authorize(), clientId, redirectUrl);
+    public static String getBaiduAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(BAIDU_AUTHORIZE_PATTERN, AuthSource.BAIDU.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -293,10 +307,11 @@ public class UrlBuilder {
     *
     * @param clientId    csdn 应用的Client ID
     * @param redirectUrl csdn 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getCsdnAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(CSDN_AUTHORIZE_PATTERN, AuthSource.CSDN.authorize(), clientId, redirectUrl);
+    public static String getCsdnAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(CSDN_AUTHORIZE_PATTERN, AuthSource.CSDN.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -326,10 +341,11 @@ public class UrlBuilder {
     *
     * @param clientId    coding 应用的Client ID
     * @param redirectUrl coding 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getCodingAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(CODING_AUTHORIZE_PATTERN, AuthSource.CODING.authorize(), clientId, redirectUrl);
+    public static String getCodingAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(CODING_AUTHORIZE_PATTERN, AuthSource.CODING.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -359,10 +375,11 @@ public class UrlBuilder {
     *
     * @param clientId    coding 应用的Client ID
     * @param redirectUrl coding 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getTencentCloudAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(TENCENT_AUTHORIZE_PATTERN, AuthSource.TENCENT_CLOUD.authorize(), clientId, redirectUrl);
+    public static String getTencentCloudAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(TENCENT_AUTHORIZE_PATTERN, AuthSource.TENCENT_CLOUD.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -393,10 +410,11 @@ public class UrlBuilder {
     *
     * @param clientId    oschina 应用的Client ID
     * @param redirectUrl oschina 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getOschinaAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(OSCHINA_AUTHORIZE_PATTERN, AuthSource.OSCHINA.authorize(), clientId, redirectUrl);
+    public static String getOschinaAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(OSCHINA_AUTHORIZE_PATTERN, AuthSource.OSCHINA.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -429,21 +447,23 @@ public class UrlBuilder {
     *
     * @param clientId    qq 应用的Client ID
     * @param redirectUrl qq 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getQqAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(QQ_AUTHORIZE_PATTERN, AuthSource.QQ.authorize(), clientId, redirectUrl, System.currentTimeMillis());
+    public static String getQqAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(QQ_AUTHORIZE_PATTERN, AuthSource.QQ.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
     * 获取qq授权地址
     *
-     * @param url   获取qqopenid的api接口地址
-     * @param token qq 应用授权的token
+     * @param url     获取qqopenid的api接口地址
+     * @param token   qq 应用授权的token
+     * @param unionid 是否需要获取unionid，默认为false。注：获取unionid需要单独发送邮件申请权限，请个人视情况而定。参考链接：http://wiki.connect.qq.com/unionid%E4%BB%8B%E7%BB%8D
     * @return full url
     */
-    public static String getQqOpenidUrl(String url, String token) {
-        return MessageFormat.format(QQ_OPENID_PATTERN, url, token);
+    public static String getQqOpenidUrl(String url, String token, boolean unionid) {
+        return MessageFormat.format(QQ_OPENID_PATTERN, url, token, unionid ? 1 : 0);
    }

    /**
@@ -451,10 +471,11 @@ public class UrlBuilder {
     *
     * @param clientId    alipay 应用的Client ID
     * @param redirectUrl alipay 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getAlipayAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(ALIPAY_AUTHORIZE_PATTERN, AuthSource.ALIPAY.authorize(), clientId, redirectUrl);
+    public static String getAlipayAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(ALIPAY_AUTHORIZE_PATTERN, AuthSource.ALIPAY.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -462,11 +483,11 @@ public class UrlBuilder {
     *
     * @param clientId    微信 应用的appid
     * @param redirectUrl 微信 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getWeChatAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(WECHAT_AUTHORIZE_PATTERN, AuthSource.WECHAT.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getWeChatAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(WECHAT_AUTHORIZE_PATTERN, AuthSource.WECHAT.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -521,11 +542,11 @@ public class UrlBuilder {
     *
     * @param clientId    Taobao 应用的Client ID
     * @param redirectUrl Taobao 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getTaobaoAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(TAOBAO_AUTHORIZE_PATTERN, AuthSource.TAOBAO.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getTaobaoAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(TAOBAO_AUTHORIZE_PATTERN, AuthSource.TAOBAO.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -533,11 +554,11 @@ public class UrlBuilder {
     *
     * @param clientId    google 应用的Client ID
     * @param redirectUrl google 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getGoogleAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(GOOGLE_AUTHORIZE_PATTERN, AuthSource.GOOGLE.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getGoogleAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(GOOGLE_AUTHORIZE_PATTERN, AuthSource.GOOGLE.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -568,11 +589,11 @@ public class UrlBuilder {
     *
     * @param clientId    Facebook 应用的Client ID
     * @param redirectUrl Facebook 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getFacebookAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(FACEBOOK_AUTHORIZE_PATTERN, AuthSource.FACEBOOK.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getFacebookAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(FACEBOOK_AUTHORIZE_PATTERN, AuthSource.FACEBOOK.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -603,11 +624,11 @@ public class UrlBuilder {
     *
     * @param clientId    Douyin 应用的Client ID
     * @param redirectUrl Douyin 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getDouyinAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(DOUYIN_AUTHORIZE_PATTERN, AuthSource.DOUYIN.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getDouyinAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(DOUYIN_AUTHORIZE_PATTERN, AuthSource.DOUYIN.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -649,11 +670,11 @@ public class UrlBuilder {
     *
     * @param clientId    Linkedin 应用的Client ID
     * @param redirectUrl Linkedin 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getLinkedinAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(LINKEDIN_AUTHORIZE_PATTERN, AuthSource.LINKEDIN.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getLinkedinAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(LINKEDIN_AUTHORIZE_PATTERN, AuthSource.LINKEDIN.authorize(), clientId, redirectUrl, state);
    }

    /**
@@ -695,11 +716,11 @@ public class UrlBuilder {
     *
     * @param clientId    微软 应用的Client ID
     * @param redirectUrl 微软 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getMicrosoftAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(MICROSOFT_AUTHORIZE_PATTERN, AuthSource.MICROSOFT.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getMicrosoftAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(MICROSOFT_AUTHORIZE_PATTERN, AuthSource.MICROSOFT.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -742,10 +763,11 @@ public class UrlBuilder {
     *
     * @param clientId    小米 应用的Client ID
     * @param redirectUrl 小米 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getMiAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(MI_AUTHORIZE_PATTERN, AuthSource.MI.authorize(), clientId, redirectUrl, System.currentTimeMillis());
+    public static String getMiAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(MI_AUTHORIZE_PATTERN, AuthSource.MI.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -790,11 +812,11 @@ public class UrlBuilder {
     *
     * @param clientId    今日头条 应用的Client ID
     * @param redirectUrl 今日头条 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
     * @return full url
     */
-    public static String getToutiaoAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(TOUTIAO_AUTHORIZE_PATTERN, AuthSource.TOUTIAO.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getToutiaoAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(TOUTIAO_AUTHORIZE_PATTERN, AuthSource.TOUTIAO.authorize(), clientId, redirectUrl, getState(state));
    }

    /**
@@ -1,6 +1,7 @@
 package me.zhyd.oauth;

 import me.zhyd.oauth.config.AuthConfig;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthResponse;
 import me.zhyd.oauth.request.*;
 import org.junit.Test;
@@ -18,11 +19,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -31,11 +33,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -45,10 +48,10 @@ public class AuthRequestTest {
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -57,11 +60,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -70,11 +74,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -83,11 +88,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -96,11 +102,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
    }

    @Test
@@ -109,11 +116,27 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void alipayTest() {
+        AuthRequest authRequest = new AuthAlipayRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .alipayPublicKey("publicKey")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }

    @Test
@@ -122,11 +145,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }

    @Test
@@ -135,11 +159,26 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void taobaoTest() {
+        AuthRequest authRequest = new AuthTaobaoRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }

    @Test
@@ -148,11 +187,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }

    @Test
@@ -161,11 +201,40 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void douyinTest() {
+        AuthRequest authRequest = new AuthDouyinRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void linkedinTest() {
+        AuthRequest authRequest = new AuthLinkedinRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }

    @Test
@@ -174,11 +243,12 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }

    @Test
@@ -187,10 +257,25 @@ public class AuthRequestTest {
                .clientId("clientId")
                .clientSecret("clientSecret")
                .redirectUri("redirectUri")
+                .state("state")
                .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
        String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void toutiaoTest() {
+        AuthRequest authRequest = new AuthToutiaoRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
    }
 }
@@ -1,3 +1,15 @@
+### 2019/06/28
+1. 修复百度登录获取不到token失效时间的问题
+2. 增加state参数校验，预防CSRF。**强烈建议启用state**！
+
+### 2019/06/27
+1. 修改login方法的参数为AuthCallback，封装回调返回的参数
+2. 支持state参数
+3. 增加code和state参数校验
+
+### 2019/06/25
+qq授权登录时，需要获取`openId`作为`uuid`，在`1.6.1-beta`和`1.7.0`版本中，引入了`unionId`这一属性。获取`unionid`需要单独向qq团队**发送邮件**申请权限，鉴于这一申请权限的步骤比较麻烦（需要填写的内容比较多），所以在`AuthConfig`中增加了一个`unionId`属性，当为**true**时才会获取unionid，当为false时只获取openId。如果你需要该功能， 则在自行申请了相关权限后，将该属性置为true即可。关于unionId的参考链接：[UnionID介绍](http://wiki.connect.qq.com/unionid%E4%BB%8B%E7%BB%8D)
+
 ### 2019/06/19
 1. 合并[xkcoding](https://github.com/xkcoding)提交的[PR](https://github.com/zhangyd-c/JustAuth/pull/14)，重构了部分代码，jar包由原来的`130+kb`优化到现在的`110+kb`
 2. 合并[skqing](https://gitee.com/skqing)提交的[PR](https://gitee.com/yadong.zhang/JustAuth/pulls/3)， 解决抖音登录失败问题
Author	SHA1	Message	Date
yadong.zhang	88048b7637	📝 编写文档	2019-06-29 15:12:49 +08:00
yadong.zhang	186ee58b72	✅ 修改测试代码	2019-06-29 07:36:08 +08:00
yadong.zhang	fa51358072	📌 升级hutool版本	2019-06-28 23:08:09 +08:00
yadong.zhang	80329c2496	✨ 全面开启state校验	2019-06-28 22:58:34 +08:00
yadong.zhang	78988555b0	🍻 完善百度登录，增加gitee登录的state校验	2019-06-28 21:33:49 +08:00
yadong.zhang	ac4ede74bf	👽 修改login方法的参数为AuthCallback，封装回调返回的参数、支持state参数、增加code和state参数校验	2019-06-27 19:39:21 +08:00
yadong.zhang	9941ce7e2a	Merge branch 'master' of https://gitee.com/yadong.zhang/JustAuth	2019-06-26 21:53:28 +08:00
yadong.zhang	4f594a4178	📝 更新githubapi文档	2019-06-26 21:52:16 +08:00
yadong.zhang	b9268f296b	Merge remote-tracking branch 'origin/master'	2019-06-25 19:33:27 +08:00
yadong.zhang	1c30f6ab2f	🎨 适配qq授权登录时开发者账号没有申请unionId权限而导致报错的问题	2019-06-25 19:32:18 +08:00
yadong.zhang	af7baa924c	📝 Writing docs.	2019-06-22 08:10:09 +08:00
yadong.zhang	9902e7eb0d	!4 优化微博登录 Merge pull request !4 from skqing/master	2019-06-22 07:43:45 +08:00
yadong.zhang	739fa786ce	Merge pull request #15 from xkcoding/patch-4 调整部分代码	2019-06-22 07:34:23 +08:00
Yangkai.Shen	6f1cead802	♻️ 枚举类使用==替换equals，提高性能参考：https://github.com/giantray/stackoverflow-java-top-qa/blob/master/contents/comparing-java-enum-members-or-equals.md	2019-06-21 15:37:42 +08:00
Yangkai.Shen	374b71e5fe	♻️ 去除工具类方法，使用原生方法	2019-06-21 15:36:41 +08:00
Yangkai.Shen	9d1ab36e21	♻️ 使用 StandardCharsets.UTF_8 替换字符串UTF-8 1. 字符串形式的 utf-8 会抛异常 2. Charset 的性能要好	2019-06-21 15:34:38 +08:00
Yangkai.Shen	b8d9f2ebc9	🐛 修复小米 scope 错误	2019-06-21 15:32:30 +08:00
skqing	c201a9ac90	优化微博登录： 1.remind_in：该参数即将废弃，开发者请使用expires_in 2.uid作为openid，否则openid为空，理论上uid也是可以作为openid的	2019-06-21 11:29:20 +08:00