{"record":{"id":"05551c07e8cca41f","repo":"binarywang/WxJava","slug":"uri-access-token","errorCode":null,"errorMessage":"uri参数中不允许有access_token: {}","messagePattern":"uri参数中不允许有access_token: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/BaseWxCpServiceImpl.java","lineNumber":394,"sourceCode":"  }\n\n  /**\n   * Execute internal t.\n   *\n   * @param <T>              the type parameter\n   * @param <E>              the type parameter\n   * @param executor         the executor\n   * @param uri              the uri\n   * @param data             the data\n   * @param doNotAutoRefresh the do not auto refresh\n   * @return the t\n   * @throws WxErrorException the wx error exception\n   */\n  protected <T, E> T executeInternal(RequestExecutor<T, E> executor, String uri, E data, boolean doNotAutoRefresh) throws WxErrorException {\n    E dataForLog = DataUtils.handleDataWithSecret(data);\n\n    if (uri.contains(\"access_token=\")) {\n      throw new IllegalArgumentException(\"uri参数中不允许有access_token: \" + uri);\n    }\n    String accessToken = getAccessToken(false);\n\n    String uriWithAccessToken = uri + (uri.contains(\"?\") ? \"&\" : \"?\") + \"access_token=\" + accessToken;\n\n    try {\n      T result = executor.execute(uriWithAccessToken, data, WxType.CP);\n      log.debug(\"\\n【请求地址】: {}\\n【请求参数】：{}\\n【响应数据】：{}\", uriWithAccessToken, dataForLog, result);\n      return result;\n    } catch (WxErrorException e) {\n      WxError error = e.getError();\n\n      if (WxConsts.ACCESS_TOKEN_ERROR_CODES.contains(error.getErrorCode())) {\n        // 强制设置wxCpConfigStorage它的access token过期了，这样在下一次请求里就会刷新access token\n        this.configStorage.expireAccessToken();\n        if (this.getWxCpConfigStorage().autoRefreshToken() && !doNotAutoRefresh) {\n          log.warn(\"即将重新获取新的access_token，错误代码：{}，错误信息：{}\", error.getErrorCode(), error.getErrorMsg());\n          //下一次不再自动重试","sourceCodeStart":376,"sourceCodeEnd":412,"githubUrl":"https://github.com/binarywang/WxJava/blob/1c43293a3c2c9d7e91304b6d037fb017f680d0c6/weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/BaseWxCpServiceImpl.java#L376-L412","documentation":"Thrown by BaseCpServiceImpl.executeInternal() when the supplied uri already contains the substring 'access_token='. The service appends access_token itself after fetching it from config storage, so a caller-provided token is treated as a misuse/leak risk and rejected with IllegalArgumentException before the request is sent.","triggerScenarios":"A caller manually appends access_token to the URL (e.g. from a cached token), or passes a full WeChat URL that already includes the query parameter, or builds the URI from a template that pre-fills access_token.","commonSituations":"Copy-pasting a full WeChat API URL with token into the uri argument; migrating from a hand-rolled client that put the token in the URL; debugging code that hardcoded a token.","solutions":["Pass the bare endpoint URL without access_token; the service injects it from config storage.","If using executeNormal with a pre-built URL, strip the access_token query param first.","Avoid logging or caching full URLs that include tokens."],"exampleFix":"// before\nString url = \"https://qyapi.weixin.qq.com/cgi-bin/...?access_token=\" + token;\nservice.get(url, null);\n// after\nString url = \"https://qyapi.weixin.qq.com/cgi-bin/...\";\nservice.get(url, null); // token added by the service","handlingStrategy":"validation","validationCode":"if (uri != null && uri.contains(\"access_token=\")) {\n  throw new IllegalArgumentException(\"uri must not include access_token; service injects it\");\n}\nservice.get(uri, null);","typeGuard":"static boolean uriHasToken(String uri) { return uri != null && uri.contains(\"access_token=\"); }","tryCatchPattern":"null","preventionTips":["Pass bare endpoint URLs; let the service append the token.","Never cache/log full URLs containing tokens.","Strip access_token before calling executeNormal with pre-built URLs."],"tags":["weixin-api","cp","access-token","validation","security"],"backgroundTag":null,"analyzedSha":"1c43293a3c2c9d7e91304b6d037fb017f680d0c6","analyzedAt":"2026-08-14T02:29:11.060Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}