{"record":{"id":"7ee5a5b9c0439435","repo":"dromara/Sa-Token","slug":"error-7ee5a5","errorCode":null,"errorMessage":"账号或密码错误，未通过校验","messagePattern":"账号或密码错误，未通过校验","errorType":"validation","errorClass":"SaTokenException","httpStatus":null,"severity":"warning","filePath":"sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java","lineNumber":38,"sourceCode":"    // 指定这个处理器要处理哪个注解\n    @Override\n    public Class<CheckAccount> getHandlerAnnotationClass() {\n        return CheckAccount.class;\n    }\n\n    // 每次请求校验注解时，会执行的方法\n    @Override\n    public void checkMethod(CheckAccount at, AnnotatedElement element) {\n        // 获取前端请求提交的参数\n        String name = SaHolder.getRequest().getParamNotNull(\"name\");\n        String pwd = SaHolder.getRequest().getParamNotNull(\"pwd\");\n\n        // 与注解中指定的值相比较\n        if(name.equals(at.name()) && pwd.equals(at.pwd()) ) {\n            // 校验通过，什么也不做\n        } else {\n            // 校验不通过，则抛出异常\n            throw new SaTokenException(\"账号或密码错误，未通过校验\");\n        }\n    }\n\n}\n","sourceCodeStart":20,"sourceCodeEnd":43,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java#L20-L43","documentation":"This is demo code in sa-token-demo-case showing how to write a custom annotation handler. CheckAccountHandler.checkMethod implements a custom @CheckAccount annotation: it reads request parameters 'name' and 'pwd' and compares them against the annotation's configured name()/pwd(). Mismatch throws SaTokenException('账号或密码错误，未通过校验'). It is example code, not library logic — hitting it means you are running the demo app.","triggerScenarios":"In the sa-token-demo-case app, requesting an endpoint annotated @CheckAccount(name=\"xxx\", pwd=\"yyy\") while the request lacks or mismatches the name/pwd query parameters. Missing parameters throw earlier in getParamNotNull.","commonSituations":"Following the custom-annotation tutorial and typing different credentials; copying the handler into your own project and forgetting that the comparison is plain string equality against hardcoded annotation values.","solutions":["Send the exact name and pwd expected by the annotation on the endpoint you are calling","Read the endpoint's annotation values (they are hardcoded in the demo controller) and match them","If you adapted this handler, replace the equality check with your real account-verification logic"],"exampleFix":"// before: endpoint has @CheckAccount(name=\"zhang\", pwd=\"123456\")\nGET /custom_annotation/check?name=zhang&pwd=111  // 401-ish exception\n\n// after\nGET /custom_annotation/check?name=zhang&pwd=123456","handlingStrategy":"validation","validationCode":"// demo-only: read the annotation values and compare before invoking\nCheckAccount at = method.getAnnotation(CheckAccount.class);\nString name = SaHolder.getRequest().getParam(\"name\");\nString pwd = SaHolder.getRequest().getParam(\"pwd\");\nif (!java.util.Objects.equals(name, at.name())\n        || !java.util.Objects.equals(pwd, at.pwd())) {\n    // return a clean 401 instead of throwing\n}","typeGuard":null,"tryCatchPattern":"try {\n    // request @CheckAccount-protected endpoint\n} catch (SaTokenException e) {\n    if (e.getMessage().contains(\"账号或密码错误\")) { /* re-prompt for credentials */ }\n}","preventionTips":["This handler is a tutorial sample — replace equality checks with real credential verification before production use","Never store real passwords as annotation attributes","Return structured 401 responses rather than raw exceptions"],"tags":["sa-token","demo","custom-annotation","authentication"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}