{"record":{"id":"0cc5c190283c6dd7","repo":"apolloconfig/apollo","slug":"the-app-id-of-path-variable-and-request-body-is-di-0cc5c1","errorCode":null,"errorMessage":"The App Id of path variable and request body is different","messagePattern":"The App Id of path variable and request body is different","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java","lineNumber":178,"sourceCode":"    if (!hasReadApplicationPermissionForCurrentIdentity(appId)) {\n      throw new BadRequestException(\"App not found: \" + appId);\n    }\n    List<OpenAppDTO> apps = appOpenApiService.getAppsInfo(Collections.singletonList(appId));\n    if (null == apps || apps.isEmpty()) {\n      throw new BadRequestException(\"App not found: \" + appId);\n    }\n    return ResponseEntity.ok(apps.get(0));\n  }\n\n  /**\n   * update app (new added)\n   */\n  @Override\n  @PreAuthorize(value = \"@unifiedPermissionValidator.isAppAdmin(#appId)\")\n  @ApolloAuditLog(type = OpType.UPDATE, name = \"App.update\")\n  public ResponseEntity<Void> updateApp(String appId, OpenAppDTO dto, String operator) {\n    if (!Objects.equals(appId, dto.getAppId())) {\n      throw new BadRequestException(\"The App Id of path variable and request body is different\");\n    }\n    validatePortalApp(dto);\n    String resolvedOperator = resolveOperator(operator);\n    dto.setDataChangeLastModifiedBy(resolvedOperator);\n    appOpenApiService.updateApp(dto, resolvedOperator);\n\n    return ResponseEntity.ok().build();\n  }\n\n  /**\n   * Get the current Consumer's application list (paginated) (new added)\n   */\n  @Override\n  public ResponseEntity<List<OpenAppDTO>> getAppsBySelf(Integer page, Integer size) {\n    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())) {\n      return ResponseEntity\n          .ok(page(filterReadableApps(this.appOpenApiService.getAllApps()), page, size));\n    }","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java#L160-L196","documentation":"Thrown by AppController.updateApp (PUT/PATCH app endpoint) when the appId in the URL path variable does not match the appId in the request body (dto.getAppId()). Apollo enforces consistency between the path and body to prevent accidental cross-app updates. Objects.equals(appId, dto.getAppId()) must be true. Results in HTTP 400.","triggerScenarios":"Calling updateApp with a URL path like /apps/my-app-A and a request body containing {\"appId\": \"my-app-B\", ...}. The mismatch between path and body triggers the guard immediately, before any validation or persistence.","commonSituations":"A client copies a request body template from one app and forgets to update the appId field to match the URL. An automation script iterates over multiple apps but passes a static body. A frontend bug where the form state and URL get out of sync.","solutions":["Ensure the appId in the request body exactly matches the appId in the URL path.","Set dto.setAppId(appId) from the path variable before sending the update request.","In client code, derive the body appId from the path variable rather than maintaining two separate values."],"exampleFix":"// before\n// PUT /openapi/v1/apps/my-app-A\nOpenAppDTO dto = fetchTemplate(\"my-app-B\"); // wrong appId\ndto.setName(\"Updated Name\");\napi.updateApp(\"my-app-A\", dto, operator);\n\n// after\nOpenAppDTO dto = fetchExisting(appId);\ndto.setAppId(appId); // sync with path variable\ndto.setName(\"Updated Name\");\napi.updateApp(appId, dto, operator);","handlingStrategy":"validation","validationCode":"// Sync the body appId with the path variable before updating\ndto.setAppId(appId); // appId from path variable\nif (!Objects.equals(appId, dto.getAppId())) {\n    throw new IllegalStateException(\"Path appId and body appId must match\");\n}\nappController.updateApp(appId, dto, operator);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always derive the body's appId from the path variable to guarantee consistency.","Never hardcode the appId in the body independently of the URL.","Add client-side validation that asserts path and body appIds match."],"tags":["openapi","app-update","validation","apollo-portal","request-consistency"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}