{"record":{"id":"8648903c4167d00d","repo":"apolloconfig/apollo","slug":"the-app-id-of-path-variable-and-request-body-is-di-864890","errorCode":null,"errorMessage":"The App Id of path variable and request body is different","messagePattern":"The App Id of path variable and request body is different","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/AppController.java","lineNumber":143,"sourceCode":"    return appService.findByAppIds(appIds, page);\n  }\n\n  @PreAuthorize(value = \"@unifiedPermissionValidator.hasCreateApplicationPermission()\")\n  @PostMapping\n  @ApolloAuditLog(type = OpType.CREATE, name = \"App.create\")\n  public App create(@Valid @RequestBody AppModel appModel) {\n\n    App app = transformToApp(appModel);\n    return appService.createAppAndAddRolePermission(app, appModel.getAdmins(),\n        userInfoHolder.getUser().getUserId());\n  }\n\n  @PreAuthorize(value = \"@unifiedPermissionValidator.isAppAdmin(#appId)\")\n  @PutMapping(\"/{appId:.+}\")\n  @ApolloAuditLog(type = OpType.UPDATE, name = \"App.update\")\n  public void update(@PathVariable String appId, @Valid @RequestBody AppModel appModel) {\n    if (!Objects.equals(appId, appModel.getAppId())) {\n      throw new BadRequestException(\"The App Id of path variable and request body is different\");\n    }\n\n    App app = transformToApp(appModel);\n\n    App updatedApp = appService.updateAppInLocal(app, userInfoHolder.getUser().getUserId());\n\n    publisher.publishEvent(new AppInfoChangedEvent(updatedApp));\n  }\n\n  @GetMapping(\"/{appId}/navtree\")\n  public MultiResponseEntity<EnvClusterInfo> nav(@PathVariable String appId) {\n\n    MultiResponseEntity<EnvClusterInfo> response = MultiResponseEntity.ok();\n    List<Env> envs = portalSettings.getActiveEnvs();\n    for (Env env : envs) {\n      try {\n        response.addResponseEntity(RichResponseEntity.ok(appService.createEnvNavNode(env, appId)));\n      } catch (Exception e) {","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/AppController.java#L125-L161","documentation":"BadRequestException (HTTP 400) from AppController.update (PUT /apps/{appId}). The handler guards that the appId in the path variable equals the appId in the submitted AppModel body; a mismatch means the client is trying to update a different app than the URL identifies, which is rejected before any service call.","triggerScenarios":"PUT /apps/{appId} (e.g. /apps/sample-app) with a request body whose appId field (appModel.getAppId()) differs from the {appId} path segment.","commonSituations":"Frontend bug sending a stale/cached AppModel; copy-paste of a curl body from another app without updating both the URL and body; id-normalization (trim/case) making the two strings unequal.","solutions":["Make the body's appId identical to the path appId before sending (set appModel.setAppId(appId)).","If your client builds the body from a fetched App, re-fetch by the same appId used in the URL.","Avoid relying on implicit defaults; always populate appId explicitly.","Add a client-side equality assertion before the PUT (see validationCode)."],"exampleFix":"// before\nPUT /apps/sample-app   body: { \"appId\": \"sampleApp\", ... }  // mismatch\n\n// after\nPUT /apps/sample-app   body: { \"appId\": \"sample-app\", ... }","handlingStrategy":"validation","validationCode":"// Assert path appId == body appId before PUT /apps/{appId}.\nString appId = pathAppId; // from URL\nif (!Objects.equals(appId, appModel.getAppId())) {\n  appModel.setAppId(appId); // fix implicitly, or abort\n}\nassert Objects.equals(appId, appModel.getAppId());","typeGuard":"static boolean appModelMatchesPath(AppModel body, String pathAppId) {\n  return body != null && Objects.equals(pathAppId, body.getAppId());\n}","tryCatchPattern":null,"preventionTips":["Always set body.appId from the same variable used to build the URL.","Re-fetch the App by the path appId before editing.","Unit-test the equality assertion in your client.","Avoid caching AppModel objects across different apps."],"tags":["app","validation","rest","id-mismatch","bad-request"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}