{"record":{"id":"0a19e0877729126d","repo":"binarywang/WxJava","slug":"uri-suite-access-token","errorCode":null,"errorMessage":"uri参数中不允许有suite_access_token: {}","messagePattern":"uri参数中不允许有suite_access_token: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"weixin-java-cp/src/main/java/me/chanjar/weixin/cp/tp/service/impl/BaseWxCpTpServiceImpl.java","lineNumber":456,"sourceCode":"\n  /**\n   * Execute internal t.\n   *\n   * @param <T>                     the type parameter\n   * @param <E>                     the type parameter\n   * @param executor                the executor\n   * @param uri                     the uri\n   * @param data                    the data\n   * @param withoutSuiteAccessToken the without suite access token\n   * @return the t\n   * @throws WxErrorException the wx error exception\n   */\n  protected <T, E> T executeInternal(RequestExecutor<T, E> executor, String uri, E data,\n                                     boolean withoutSuiteAccessToken) throws WxErrorException {\n    E dataForLog = DataUtils.handleDataWithSecret(data);\n\n    if (uri.contains(\"suite_access_token=\")) {\n      throw new IllegalArgumentException(\"uri参数中不允许有suite_access_token: \" + uri);\n    }\n    String uriWithAccessToken;\n    if (!withoutSuiteAccessToken) {\n      String suiteAccessToken = getSuiteAccessToken(false);\n      uriWithAccessToken = uri + (uri.contains(\"?\") ? \"&\" : \"?\") + \"suite_access_token=\" + suiteAccessToken;\n    } else {\n      uriWithAccessToken = uri;\n    }\n\n\n    try {\n      T result = executor.execute(uriWithAccessToken, data, WxType.CP);\n      log.debug(\"\\n【请求地址】: {}\\n【请求参数】：{}\\n【响应数据】：{}\", uriWithAccessToken, dataForLog, result);\n      return result;\n    } catch (WxErrorException e) {\n      WxError error = e.getError();\n      /*\n       * 发生以下情况时尝试刷新suite_access_token","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/binarywang/WxJava/blob/1c43293a3c2c9d7e91304b6d037fb017f680d0c6/weixin-java-cp/src/main/java/me/chanjar/weixin/cp/tp/service/impl/BaseWxCpTpServiceImpl.java#L438-L474","documentation":"Thrown as IllegalArgumentException when executeInternal detects that the caller-supplied URI already contains 'suite_access_token=' as a query parameter. The library injects the suite access token automatically; passing a URI that pre-embeds the token is treated as a programming error to prevent token duplication or leakage.","triggerScenarios":"Caller passes a URI string containing 'suite_access_token=xxx' to any service method that routes through executeInternal, e.g., service.get('https://qyapi.weixin.qq.com/...?suite_access_token=TOKEN&type=1', null).","commonSituations":"Copy-paste from WeChat API documentation that includes the token parameter in sample URLs; manually pre-building URLs with the token; debugging code left in production.","solutions":["Remove 'suite_access_token=...' from the URI string before passing it to the service method","Pass only the base API path and non-token query parameters; the library appends the token automatically","If building URLs dynamically, strip any existing suite_access_token parameter: uri = uri.replaceAll('[?&]suite_access_token=[^&]*', '')"],"exampleFix":"// before\nservice.get(\"https://qyapi.weixin.qq.com/cgi-bin/service/get_login_info?suite_access_token=TOKEN\", body);\n\n// after\nservice.get(\"https://qyapi.weixin.qq.com/cgi-bin/service/get_login_info\", body);","handlingStrategy":"validation","validationCode":"// Validate URI before calling the service\nif (uri != null && uri.contains(\"suite_access_token=\")) {\n  throw new IllegalArgumentException(\"URI must not contain suite_access_token; the library injects it automatically\");\n}\nservice.get(uri, data);","typeGuard":"private static boolean isUriSafe(String uri) {\n  return uri != null && !uri.contains(\"suite_access_token=\");\n}","tryCatchPattern":"try {\n  service.get(uri, data);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"suite_access_token\")) {\n    uri = uri.replaceAll(\"[?&]suite_access_token=[^&]*\", \"\");\n    service.get(uri, data);\n  } else {\n    throw e;\n  }\n}","preventionTips":["Never manually append suite_access_token to URIs — the library handles token injection","When copying URLs from WeChat API docs, strip the token parameter","Build URIs from API path constants rather than constructing full URLs manually"],"tags":["validation","weixin-cp","configuration","tp","uri"],"backgroundTag":null,"analyzedSha":"1c43293a3c2c9d7e91304b6d037fb017f680d0c6","analyzedAt":"2026-08-14T02:29:11.060Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}