{"record":{"id":"5028f3e3c4a7e123","repo":"binarywang/WxJava","slug":"uri-access-token-5028f3","errorCode":null,"errorMessage":"uri参数中不允许有access_token: ","messagePattern":"uri参数中不允许有access_token: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/BaseWxMaServiceImpl.java","lineNumber":430,"sourceCode":"          } catch (InterruptedException e1) {\n            Thread.currentThread().interrupt();\n          }\n        } else {\n          throw e;\n        }\n      }\n    } while (retryTimes++ < this.maxRetryTimes);\n\n    log.warn(\"重试达到最大次数【{}】\", this.maxRetryTimes);\n    throw new WxRuntimeException(\"微信服务端异常，超出重试次数\");\n  }\n\n  private <R, T> R executeInternal(\n      ExecutorAction<R> executor, String uri, String dataForLog, boolean doNotAutoRefreshToken)\n      throws WxErrorException {\n\n    if (uri.contains(\"access_token=\")) {\n      throw new IllegalArgumentException(\"uri参数中不允许有access_token: \" + uri);\n    }\n    String accessToken = getAccessToken(false);\n\n    String effectiveApiHostUrl = this.getWxMaConfig().getEffectiveApiHostUrl();\n    if (!WxMaConfig.DEFAULT_API_HOST_URL.equals(effectiveApiHostUrl)) {\n      uri = uri.replace(WxMaConfig.DEFAULT_API_HOST_URL, effectiveApiHostUrl);\n    }\n\n    String uriWithAccessToken =\n        uri + (uri.contains(\"?\") ? \"&\" : \"?\") + \"access_token=\" + accessToken;\n    try {\n      R result = executor.execute(uriWithAccessToken);\n      log.debug(\"\\n【请求地址】: {}\\n【请求参数】：{}\\n【响应数据】：{}\", uriWithAccessToken, dataForLog, result);\n      return result;\n    } catch (WxErrorException e) {\n      WxError error = e.getError();\n      if (WxConsts.ACCESS_TOKEN_ERROR_CODES.contains(error.getErrorCode())) {\n        // 强制设置WxMaConfig的access token过期了，这样在下一次请求里就会刷新access token","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/binarywang/WxJava/blob/1c43293a3c2c9d7e91304b6d037fb017f680d0c6/weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/BaseWxMaServiceImpl.java#L412-L448","documentation":"Thrown as IllegalArgumentException when executeInternal detects that the caller-supplied URI already contains 'access_token=' as a query parameter. The MiniApp library injects the access token automatically after the URI; pre-embedding the token is treated as a programming error.","triggerScenarios":"Caller passes a URI string containing 'access_token=xxx' to any MiniApp service method routed through executeInternal, e.g., service.get('https://api.weixin.qq.com/...?access_token=TOKEN&foo=bar', null).","commonSituations":"Copy-paste from WeChat API documentation sample URLs that include the token parameter; manually building URLs with the token included; debugging code left in production.","solutions":["Remove 'access_token=...' from the URI string before passing it to the service method","Pass only the base API path and non-token query parameters; the library appends the token automatically","If building URLs dynamically, strip any existing access_token parameter before calling"],"exampleFix":"// before\nservice.get(\"https://api.weixin.qq.com/cgi-bin/draft/get?access_token=TOKEN\", null);\n\n// after\nservice.get(\"https://api.weixin.qq.com/cgi-bin/draft/get\", null);","handlingStrategy":"validation","validationCode":"// Validate URI before calling the service\nif (uri != null && uri.contains(\"access_token=\")) {\n  throw new IllegalArgumentException(\"URI must not contain access_token; the library injects it automatically\");\n}\nservice.get(uri, null);","typeGuard":"private static boolean isUriSafe(String uri) {\n  return uri != null && !uri.contains(\"access_token=\");\n}","tryCatchPattern":"try {\n  service.get(uri, null);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"access_token\")) {\n    uri = uri.replaceAll(\"[?&]access_token=[^&]*\", \"\");\n    service.get(uri, null);\n  } else {\n    throw e;\n  }\n}","preventionTips":["Never manually append access_token to URIs — the library handles token injection","When copying URLs from WeChat API docs, strip the token parameter","Build URIs from API path constants rather than constructing full URLs manually"],"tags":["validation","miniapp","configuration","uri"],"backgroundTag":null,"analyzedSha":"1c43293a3c2c9d7e91304b6d037fb017f680d0c6","analyzedAt":"2026-08-14T02:29:11.060Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}