{"record":{"id":"84314e4c8b0914fd","repo":"apolloconfig/apollo","slug":"add-favorite-fail-because-favorite-s-user-is-not","errorCode":null,"errorMessage":"add favorite fail. because favorite's user is not current login user.","messagePattern":"add favorite fail\\. because favorite's user is not current login user\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java","lineNumber":55,"sourceCode":"  private final FavoriteRepository favoriteRepository;\n  private final UserService userService;\n\n  public FavoriteService(final FavoriteRepository favoriteRepository,\n      final UserService userService) {\n    this.favoriteRepository = favoriteRepository;\n    this.userService = userService;\n  }\n\n\n  public Favorite addFavorite(Favorite favorite, String loginUserId) {\n    UserInfo user = userService.findByUserId(favorite.getUserId());\n    if (user == null) {\n      throw BadRequestException.userNotExists(favorite.getUserId());\n    }\n\n    // user can only add himself favorite app\n    if (!Objects.equals(loginUserId, user.getUserId())) {\n      throw new BadRequestException(\n          \"add favorite fail. \" + \"because favorite's user is not current login user.\");\n    }\n\n    Favorite checkedFavorite =\n        favoriteRepository.findByUserIdAndAppId(loginUserId, favorite.getAppId());\n    if (checkedFavorite != null) {\n      return checkedFavorite;\n    }\n\n    favorite.setPosition(POSITION_DEFAULT);\n    favorite.setDataChangeCreatedBy(user.getUserId());\n    favorite.setDataChangeLastModifiedBy(user.getUserId());\n\n    return favoriteRepository.save(favorite);\n  }\n\n\n  public List<Favorite> search(String userId, String appId, Pageable page, String loginUserId) {","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java#L37-L73","documentation":"Thrown as a BadRequestException by FavoriteService.addFavorite() when the favorite's userId does not match the loginUserId. Apollo enforces that a user can only add favorites for themselves — the favorite entity's userId must equal the authenticated user's ID. This is an authorization guard preventing impersonation.","triggerScenarios":"Calling addFavorite with a Favorite object whose userId differs from the loginUserId parameter. For example, a client sets favorite.setUserId('userA') but the authenticated session belongs to 'userB'. The check happens after verifying the user exists.","commonSituations":"Client-side bug setting the wrong userId on the Favorite object; session/token mismatch where loginUserId is stale or from a different session; attempting to programmatically add favorites on behalf of another user; SSO integration providing inconsistent user IDs.","solutions":["Ensure the Favorite object's userId matches the currently authenticated user's ID before calling addFavorite.","On the client side, derive userId from the logged-in session rather than user input.","Verify the loginUserId passed to addFavorite comes from the authenticated principal, not from a request parameter."],"exampleFix":"// before\nFavorite fav = new Favorite();\nfav.setUserId(request.getParameter(\"userId\"));\nfav.setAppId(appId);\nfavoriteService.addFavorite(fav, loginUserId);\n// after - always use the authenticated user's id\nFavorite fav = new Favorite();\nfav.setUserId(loginUserId);\nfav.setAppId(appId);\nfavoriteService.addFavorite(fav, loginUserId);","handlingStrategy":"validation","validationCode":"// Ensure favorite belongs to the current user before adding\nif (!Objects.equals(favorite.getUserId(), loginUserId)) {\n  throw new IllegalStateException(\n    \"Cannot add favorite for a different user: \" + favorite.getUserId());\n}\nfavoriteService.addFavorite(favorite, loginUserId);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set the Favorite's userId from the authenticated session, not from user input.","Derive loginUserId from the security context, not from a request parameter.","Add client-side validation to prevent submitting favorites for other users."],"tags":["apollo-portal","favorite","authorization","bad-request","user-mismatch"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}