What causes "token 不能为空" in YMFE/yapi?

Ensure the caller fetches a valid project token from the `token` collection (e.g. project.token or token table) before calling getToken

YMFE/yapi · error

token 不能为空

Error message

token 不能为空

What it means

getToken() in server/utils/token.js throws this when called with a falsy token. The function encodes `uid|token` with AES-like aseEncode and requires a non-empty token to build a credential.

Source

Thrown at server/utils/token.js:45

   第二个参数用于指定解密时所使用的密码，其参数值为一个二进制格式的字符串或一个Buffer对象，该密码同样必须与加密该数据时所使用的密码保持一致
  */
  const decipher = crypto.createDecipher('aes192', password);

  /*
   第一个参数为一个Buffer对象或一个字符串，用于指定需要被解密的数据
   第二个参数用于指定被解密数据所使用的编码格式，可指定的参数值为 'hex', 'binary', 'base64'等，
   第三个参数用于指定输出解密数据时使用的编码格式，可选参数值为 'utf-8', 'ascii' 或 'binary';
  */
  let decrypted = decipher.update(data, 'hex', 'utf-8');

  decrypted += decipher.final('utf-8');
  return decrypted;
}; 

const defaultSalt = 'abcde';

exports.getToken = function getToken(token, uid){
  if(!token)throw new Error('token 不能为空')
  yapi.WEBCONFIG.passsalt = yapi.WEBCONFIG.passsalt || defaultSalt;
  return aseEncode(uid + '|' + token, yapi.WEBCONFIG.passsalt)
}

exports.parseToken = function parseToken(token){
  if(!token)throw new Error('token 不能为空')
  yapi.WEBCONFIG.passsalt = yapi.WEBCONFIG.passsalt || defaultSalt;
  let tokens;
  try{
    tokens = aseDecode(token, yapi.WEBCONFIG.passsalt)
  }catch(e){}  
  if(tokens && typeof tokens === 'string' && tokens.indexOf('|') > 0){
    tokens = tokens.split('|')
    return {
      uid: tokens[0],
      projectToken: tokens[1]
    }
  }

View on GitHub (pinned to 59bade3a8a)

Solutions

Ensure the caller fetches a valid project token from the `token` collection (e.g. project.token or token table) before calling getToken
Validate the token value is a non-empty string before calling getToken
Fix upstream code that passes the result of a failed lookup (null/undefined) directly into getToken

Example fix

// before
const t = await tokenModel.get(projectId, 'interface');
const tokenStr = yapi.commons.getToken(t, uid);
// after
const t = await tokenModel.get(projectId, 'interface');
if (!t) throw new Error('project token not found, generate one in project settings');
const tokenStr = yapi.commons.getToken(t, uid);

Defensive patterns

Strategy: validation

Validate before calling

function safeGetToken(token, uid){ if (typeof token !== 'string' || token.length === 0) throw new TypeError('getToken requires a non-empty token string'); return yapi.commons.getToken(token, uid); }

Type guard

function isNonEmptyString(v){ return typeof v === 'string' && v.length > 0; }

Try / catch

try {
  const t = yapi.commons.getToken(token, uid);
} catch (e) {
  if (e.message === 'token 不能为空') { /* prompt user to generate a project token */ }
  else throw e;
}

Prevention

Always fetch the token from the project's token record and check it exists before encoding
Never pass raw DB query results directly into getToken without a null check
Surface a clear 'generate token first' message in the UI when no token exists

When it happens

Trigger: Calling yapi.commons.getToken('', uid), getToken(null, uid), or getToken(undefined, uid); typically a login/OpenAPI flow where the token field was never populated.

Common situations: A project token was deleted or never created; DB lookup returned null/undefined; request body omitted the token field; migration left token column empty.

Related errors

AI-assisted analysis of YMFE/yapi@59bade3a8a (2026-08-29). Data as JSON: /api/errors/d320a20a6d5f6c95. Report an issue: GitHub.