{"record":{"id":"991b22afb4732102","repo":"flowable/flowable-engine","slug":"userid-is-null-991b22","errorCode":null,"errorMessage":"userId is null","messagePattern":"userId is null","errorType":"validation","errorClass":"FlowableIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessDefinitionQueryImpl.java","lineNumber":360,"sourceCode":"        this.eventSubscriptionName = eventName;\n        return this;\n    }\n\n    public Collection<String> getAuthorizationGroups() {\n        if (authorizationGroupsSet) {\n            // if authorizationGroupsSet is true then startableByUserOrGroups was called\n            // and the groups passed in that methods have precedence\n            return authorizationGroups;\n        } else if (authorizationUserId == null) {\n            return null;\n        }\n        return CommandContextUtil.getProcessEngineConfiguration().getCandidateManager().getGroupsForCandidateUser(authorizationUserId);\n    }\n\n    @Override\n    public ProcessDefinitionQueryImpl startableByUser(String userId) {\n        if (userId == null) {\n            throw new FlowableIllegalArgumentException(\"userId is null\");\n        }\n        this.authorizationUserId = userId;\n        return this;\n    }\n\n    @Override\n    public ProcessDefinitionQuery startableByUserOrGroups(String userId, Collection<String> groups) {\n        if (userId == null && (groups == null || groups.isEmpty())) {\n            throw new FlowableIllegalArgumentException(\"userId is null and groups are null or empty\");\n        }\n        this.authorizationUserId = userId;\n        this.authorizationGroups = groups;\n        this.authorizationGroupsSet = true;\n        return this;\n    }\n\n    // sorting ////////////////////////////////////////////\n","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessDefinitionQueryImpl.java#L342-L378","documentation":"startableByUser(String) restricts a ProcessDefinitionQuery to definitions the given user can start. Flowable throws FlowableIllegalArgumentException when userId is null since start-authorization filtering requires a concrete user identity.","triggerScenarios":"Calling startableByUser(null), usually when the current authenticated user is not resolved (anonymous session, missing security context) and the user id variable is null.","commonSituations":"Endpoints exposed without authentication; task/list UIs showing definitions before login; identities stored in an external IdP where the Flowable user id mapping is absent.","solutions":["Resolve and pass the actual Flowable user id of the potential starter.","Skip the startableByUser call (and any authorization filter) for unauthenticated/anonymous listings.","Fail fast earlier with a clear 'authentication required' error instead of the query-time argument error."],"exampleFix":"// before\nString userId = SecurityUtils.getCurrentUserId();\nreturn repositoryService.createProcessDefinitionQuery().startableByUser(userId).list();\n\n// after\nString userId = SecurityUtils.getCurrentUserId();\nProcessDefinitionQuery query = repositoryService.createProcessDefinitionQuery();\nif (userId != null) {\n    query.startableByUser(userId);\n}\nreturn query.list();","handlingStrategy":"validation","validationCode":"if (userId != null) { query.startableByUser(userId); }","typeGuard":null,"tryCatchPattern":"try { query.startableByUser(userId); } catch (FlowableIllegalArgumentException e) { throw new AuthenticationRequiredException(\"user must be authenticated to filter by starter\"); }","preventionTips":["Require authentication before queries that filter by user.","Skip authorization filters for anonymous listing endpoints explicitly.","Keep user-id resolution in one utility that throws a clear auth error on missing identity."],"tags":["java","flowable","authorization","null-argument"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T16:17:23.245Z"}