{"record":{"id":"81fbe0cf868878d3","repo":"apolloconfig/apollo","slug":"username-and-password-can-not-be-empty-81fbe0","errorCode":null,"errorMessage":"Username and password can not be empty.","messagePattern":"Username and password can not be empty\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java","lineNumber":72,"sourceCode":"  private final AuthUserPasswordChecker passwordChecker;\n  private final UnifiedPermissionValidator unifiedPermissionValidator;\n\n  public UserInfoController(final UserInfoHolder userInfoHolder, final LogoutHandler logoutHandler,\n      final UserService userService, final AuthUserPasswordChecker passwordChecker,\n      UnifiedPermissionValidator unifiedPermissionValidator) {\n    this.userInfoHolder = userInfoHolder;\n    this.logoutHandler = logoutHandler;\n    this.userService = userService;\n    this.passwordChecker = passwordChecker;\n    this.unifiedPermissionValidator = unifiedPermissionValidator;\n  }\n\n  @PostMapping(\"/users\")\n  public void createOrUpdateUser(\n      @RequestParam(value = \"isCreate\", defaultValue = \"false\") boolean isCreate,\n      @RequestBody UserPO user) {\n    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {\n      throw new BadRequestException(\"Username and password can not be empty.\");\n    }\n\n    if (!unifiedPermissionValidator.isSuperAdmin()\n        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())\n            || user.getEnabled() != USER_ENABLED)) {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n\n    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());\n    if (!pwdCheckRes.isSuccess()) {\n      throw new BadRequestException(pwdCheckRes.getMessage());\n    }\n\n    if (userService instanceof SpringSecurityUserService) {\n      if (isCreate) {\n        ((SpringSecurityUserService) userService).create(user);\n      } else {\n        ((SpringSecurityUserService) userService).update(user);","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java#L54-L90","documentation":"Thrown by UserInfoController.createOrUpdateUser (POST /users) when StringUtils.isContainEmpty(username, password) is true, i.e. the request body's UserPO has a blank username or password. It is a BadRequestException mapped to HTTP 400. Note this legacy controller is @Deprecated in favor of /openapi/v1 endpoints.","triggerScenarios":"POST /users with isCreate flag and a UserPO body whose username or password field is null/empty/whitespace-only. Common when the client omits a field or sends an empty string.","commonSituations":"Frontend form submitting before validation; API client serializing a partially-populated DTO; integration test that forgets to set the password; JSON field-name mismatch (e.g. pass vs password) silently leaving the field null.","solutions":["Ensure both username and password are non-blank in the request body before POSTing.","Add client-side validation: reject empty username/password before the call.","Verify the JSON field names exactly match UserPO.getUsername()/getPassword() (username, password).","Migrate to the /openapi/v1 user endpoints if building new integrations; this controller is deprecated."],"exampleFix":"// before\nUserPO u = new UserPO();\nu.setUsername(\"alice\");\npostUsers(u, true);\n\n// after\nif (StringUtils.isContainEmpty(u.getUsername(), u.getPassword())) {\n  throw new IllegalStateException(\"username and password are required client-side\");\n}\npostUsers(u, true);","handlingStrategy":"validation","validationCode":"if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {\n  return ResponseEntity.badRequest().body(\"username and password are required\");\n}","typeGuard":"boolean isCreatableUser(UserPO u) { return u != null && !StringUtils.isContainEmpty(u.getUsername(), u.getPassword()); }","tryCatchPattern":null,"preventionTips":["Validate non-blank username/password client-side before POST /users.","Match JSON field names to UserPO (username, password).","Prefer the /openapi/v1 user endpoints for new integrations."],"tags":["apollo-portal","user-management","validation","deprecated"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}