Tencent/APIJSON · error · NotLoggedInException

未登录或登录过期，请登录后再操作！

Error message

未登录或登录过期，请登录后再操作！

What it means

verifyLogin() throws NotLoggedInException when visitorId is null — the first of three login checks. verifyLogin is reached whenever a request's role is anything other than UNKNOWN (see verifyAccess) or via explicit login-requiring paths. A null visitorId means the request executed with no authenticated visitor at all (no session/auth resolved to a visitor id).

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:473

			break;
		case ADMIN://这里不好做，在特定接口内部判。 可以是  /get/admin + 固定秘钥  Parser#needVerify，之后全局跳过验证
			verifyAdmin();
			break;
		default://unknown，verifyRole通过就行
			break;
		}

		//验证角色，假定真实强制匹配>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
	}


	/**登录校验
	 */
	@Override
	public void verifyLogin() throws Exception {
		//未登录没有权限操作
		if (visitorId == null) {
			throw new NotLoggedInException("未登录或登录过期，请登录后再操作！");
		}

		if (visitorId instanceof Number) {
			if (((Number) visitorId).longValue() <= 0) {
				throw new NotLoggedInException("未登录或登录过期，请登录后再操作！");
			}
		}
		else if (visitorId instanceof String) {
			if (StringUtil.isEmpty(visitorId, true)) {
				throw new NotLoggedInException("未登录或登录过期，请登录后再操作！");
			}
		}
		else {
			throw new UnsupportedDataTypeException("visitorId 只能是 Long 或 String 类型！");
		}

	}

View on GitHub (pinned to 5284052872)

Solutions

1. Authenticate first (login endpoint) and send the session cookie / credential header with the request.
2. Check the server-side auth chain: the Parser/Verifier visitor must be populated from the session before role verification runs.
3. If the endpoint should be public, send the request without a logged-in role (role UNKNOWN / omit role) so verifyLogin is not required.
4. Handle NotLoggedInException in the client to redirect to login instead of retrying.

Example fix

// before
GET /get { "User": { "id": 1 }, "@role": "LOGIN" }  // no cookie

// after
POST /login { ... }  // obtain session
GET /get { "User": { "id": 1 }, "@role": "LOGIN" }  // with session cookie

if (verifier.visitorId == null) { redirect to login instead of issuing the role-protected request; }

boolean isLoggedIn(Object visitorId) { return visitorId != null; }

catch (NotLoggedInException e) { respond 401; client clears stale credentials and routes to login; never retry the same request.

When it happens

Trigger: A request with a logged-in role ("role":"LOGIN"/OWNER/CONTACT/...) arrives with no or invalid credentials, so the framework never set visitorId; verifyLogin()'s first branch throws.

Common situations: Missing/expired session cookie or auth token; auth filter not wired (visitor never attached to the request context); testing in a fresh environment with no login performed; token parsing silently failing so visitorId stays null.

Related errors

• visitorId 只能是 Long 或 String 类型！
• Value for key '" + key + "' is not a Map: " + value.getClass
• Value for key '" + key + "' is not a List: " + value.getClas
• Cannot convert String value '" + value + "' to int: " + e.ge
• Cannot convert value of type " + value.getClass().getName()

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/aa3f3cef9e196c7a. Report an issue: GitHub.