{"record":{"id":"5810d73fccf5345c","repo":"dromara/Sa-Token","slug":"parametername","errorCode":null,"errorMessage":"非法请求参数：{parameterName}","messagePattern":"非法请求参数：(.+?)","errorType":"exception","errorClass":"FirewallCheckException","httpStatus":null,"severity":"error","filePath":"sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForParameter.java","lineNumber":67,"sourceCode":"     * @param notAllowParameterNames 不允许的请求参数列表 (先清空原来的，再添加上新的)\n     */\n    public void resetConfig(String... notAllowParameterNames) {\n        this.notAllowParameterNames.clear();\n        this.notAllowParameterNames.addAll(Arrays.asList(notAllowParameterNames));\n    }\n\n    /**\n     * 执行的方法\n     *\n     * @param req 请求对象\n     * @param res 响应对象\n     * @param extArg 预留扩展参数\n     */\n    @Override\n    public void execute(SaRequest req, SaResponse res, Object extArg) {\n        for (String parameterName : notAllowParameterNames) {\n            if(req.getParam(parameterName) != null) {\n                throw new FirewallCheckException(\"非法请求参数：\" + parameterName);\n            }\n        }\n    }\n\n}\n","sourceCodeStart":49,"sourceCodeEnd":73,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForParameter.java#L49-L73","documentation":"The Parameter firewall hook iterates the configured notAllowParameterNames list and throws FirewallCheckException if the request contains any of those query/form parameters with a non-null value (mere presence is enough; the value itself is irrelevant). It is used to reject parameter smuggling of fields the framework treats specially, such as satoken token-submission parameters.","triggerScenarios":"A GET/POST request carrying a query or form parameter whose name appears in sa-token.firewall.not-allow-parameter-names — most commonly 'satoken' when the app submits the token via query string while the parameter deny-list blocks it.","commonSituations":"Frontend appending the token as ?satoken=xxx on image/file downloads while the firewall blocks that parameter; a third-party callback (OAuth, payment notify) sending a blocked parameter name; versions whose default deny-list includes parameters your integration now uses.","solutions":["Stop sending the blocked parameter — submit the token via header (satoken: xxx) or cookie instead of query string","Remove the parameter name from sa-token.firewall.not-allow-parameter-names if it is legitimately required","For third-party callbacks, remap the parameter on your gateway before it reaches the app"],"exampleFix":"// before: token passed as query parameter (blocked)\nfetch('/api/user?satoken=' + token);\n\n// after: token passed via header\nfetch('/api/user', { headers: { satoken: token } });","handlingStrategy":"validation","validationCode":"Set<String> denied = new HashSet<>(\n    SaManager.getConfig().getFirewall().getNotAllowParameterNames());\nfor (String p : denied) {\n    if (req.getParam(p) != null) { /* strip/reject before firewall */ }\n}","typeGuard":null,"tryCatchPattern":"try {\n    chain.doFilter(req, res);\n} catch (FirewallCheckException e) {\n    res.setStatus(400);\n}","preventionTips":["Submit tokens via header or cookie, never as a query parameter","Audit third-party callback parameter names against the deny-list","Keep the deny-list minimal and intentional"],"tags":["sa-token","firewall","security","request-parameters"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}