alibaba/spring-ai-alibaba · error · BizException

INVALID_PARAMS

INVALID_PARAMS

Error message

username

What it means

BizException with ErrorCode.INVALID_PARAMS thrown by AuthController.login when loginRequest.getUsername() is blank (null or whitespace). Login requires both username and password to issue an access/refresh TokenResponse; a blank username is rejected with INVALID_PARAMS before credential checking.

Source

Thrown at spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-start/src/main/java/com/alibaba/cloud/ai/studio/admin/builder/controller/AuthController.java:58

 */
@RestController
@Tag(name = "auth")
@RequestMapping("/console/v1/auth")
@RequiredArgsConstructor
public class AuthController {

	/** Account service for handling authentication operations */
	private final AccountService accountService;

	/**
	 * Authenticates user and returns access tokens.
	 * @param loginRequest User credentials
	 * @return Access and refresh tokens
	 */
	@PostMapping("/login")
	public Result<TokenResponse> login(@RequestBody LoginRequest loginRequest) {
		if (StringUtils.isBlank(loginRequest.getUsername())) {
			throw new BizException(ErrorCode.INVALID_PARAMS.toError("username"));
		}

		if (StringUtils.isBlank(loginRequest.getPassword())) {
			throw new BizException(ErrorCode.INVALID_PARAMS.toError("password"));
		}

		TokenResponse response = accountService.login(loginRequest);
		return Result.success(IdGenerator.uuid(), response);
	}

	/**
	 * Refreshes access token using refresh token.
	 * @param request Refresh token request
	 * @return New access and refresh tokens
	 */
	@PostMapping("/refresh-token")
	public Result<TokenResponse> refreshToken(@RequestBody RefreshTokenRequest request) {
		if (StringUtils.isBlank(request.getRefreshToken())) {

View on GitHub (pinned to f82da0b50f)

Solutions

1. Send a non-blank username in the JSON body along with the password.
2. Add client-side validation requiring a non-empty username before submitting the login form.
3. Ensure Content-Type: application/json and that the body actually deserializes into LoginRequest (field name must match 'username').
4. If credentials come from env/config, verify the username variable is populated and not empty.

Example fix

// before
POST /auth/login
{"username": "", "password": "secret"}
// after
POST /auth/login
{"username": "admin", "password": "secret"}

if (loginRequest == null || loginRequest.getUsername() == null || loginRequest.getUsername().isBlank()) { throw new IllegalArgumentException("username is required"); }

boolean hasUsername(LoginRequest r) { return r != null && r.getUsername() != null && !r.getUsername().isBlank(); }

try { api.login(loginRequest); } catch (BizException e) { if (e.getMessage().contains("username")) { /* surface field-level error to the login form */ } }

When it happens

Trigger: POST to the auth login endpoint with a JSON body whose username field is null, absent, empty, or whitespace-only (e.g. {"username":"","password":"x"}).

Common situations: Login forms submitted with the username field empty; clients omitting the username property in the JSON payload; trimming issues where input is only spaces; front-end state not synced before submit.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• Oauth2UserNotFound
• URL路径不能为空
• 评测集名称不能为空
• INVALID_PARAMS
• DefaultWorkspaceNotFound

AI-assisted analysis of alibaba/spring-ai-alibaba@f82da0b50f (2026-09-09). Data as JSON: /api/errors/a3bf3c74728c3ffd. Report an issue: GitHub.