{"record":{"id":"297d5dcb81ea08fe","repo":"Activiti/Activiti","slug":"user-id-is-null","errorCode":null,"errorMessage":"user id is null","messagePattern":"user id is null","errorType":"validation","errorClass":"ActivitiIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/ExecutionQueryImpl.java","lineNumber":342,"sourceCode":"            throw new ActivitiIllegalArgumentException(\"before time is null\");\n        }\n        this.startedBefore = beforeTime;\n\n        return this;\n    }\n\n    public ExecutionQuery startedAfter(Date afterTime) {\n        if (afterTime == null) {\n            throw new ActivitiIllegalArgumentException(\"after time is null\");\n        }\n        this.startedAfter = afterTime;\n\n        return this;\n    }\n\n    public ExecutionQuery startedBy(String userId) {\n        if (userId == null) {\n            throw new ActivitiIllegalArgumentException(\"user id is null\");\n        }\n        this.startedBy = userId;\n\n        return this;\n    }\n\n    // ordering ////////////////////////////////////////////////////\n\n    public ExecutionQueryImpl orderByProcessInstanceId() {\n        this.orderProperty = ExecutionQueryProperty.PROCESS_INSTANCE_ID;\n        return this;\n    }\n\n    public ExecutionQueryImpl orderByProcessDefinitionId() {\n        this.orderProperty = ExecutionQueryProperty.PROCESS_DEFINITION_ID;\n        return this;\n    }\n","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/Activiti/Activiti/blob/56435b1a97deeafdc09dd40074b056c89fba5a8a/activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/ExecutionQueryImpl.java#L324-L360","documentation":"ExecutionQueryImpl.startedBy(String userId) filters executions started by a specific user. The userId is mandatory; null triggers ActivitiIllegalArgumentException('user id is null') at query construction. Fail-fast validation avoids queries whose filter silently degrades.","triggerScenarios":"Calling executionQuery.startedBy(null), typically when the authenticated user id is unavailable (anonymous request, security context not populated) and is passed straight into the query.","commonSituations":"'My processes' dashboard endpoints hit without authentication, or code that reads the current user from a SecurityContext/ThreadLocal that is empty in async/scheduled threads.","solutions":["Require authentication and resolve a non-null user id before building the query; return 401/400 otherwise.","Skip the startedBy filter when no user filter is intended (e.g. admin views all instances).","Fix security-context propagation so async jobs and background threads carry the user id.","Guard: if (userId != null) query.startedBy(userId);"],"exampleFix":"// before\nExecutionQuery q = runtimeService.createExecutionQuery().startedBy(securityContext.getUserId());\n// after\nString userId = securityContext.getUserId();\nif (userId == null) { throw new UnauthorizedException(\"user id required\"); }\nExecutionQuery q = runtimeService.createExecutionQuery().startedBy(userId);","handlingStrategy":"validation","validationCode":"if (userId == null || userId.isEmpty()) { throw new SecurityException(\"userId must be resolved (authenticated user) before startedBy()\"); }","typeGuard":"boolean hasUserId(String userId) { return userId != null && !userId.trim().isEmpty(); }","tryCatchPattern":"try { query.startedBy(userId); } catch (ActivitiIllegalArgumentException e) { if (e.getMessage().equals(\"user id is null\")) { throw new UnauthorizedException(\"Authentication required to filter by starter\"); } throw e; }","preventionTips":["Enforce authentication before user-scoped queries; reject anonymous access.","Propagate security context into async/scheduled threads that build queries.","For 'all users' views, omit startedBy entirely rather than passing null."],"tags":["activiti","null-argument","query-validation"],"backgroundTag":"null-argument","analyzedSha":"56435b1a97deeafdc09dd40074b056c89fba5a8a","analyzedAt":"2026-09-09T21:00:06.703Z","contentChangedAt":"2026-09-09T21:00:06.703Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}