{"record":{"id":"a1aa018a146a85cf","repo":"shuzheng/zheng","slug":"error","errorCode":null,"errorMessage":"无效访问！","messagePattern":"无效访问！","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"zheng-upms/zheng-upms-server/src/main/java/com/zheng/upms/server/controller/SSOController.java","lineNumber":71,"sourceCode":"    // code key\n    private final static String ZHENG_UPMS_SERVER_CODE = \"zheng-upms-server-code\";\n\n    @Autowired\n    UpmsSystemService upmsSystemService;\n\n    @Autowired\n    UpmsUserService upmsUserService;\n\n    @Autowired\n    UpmsSessionDao upmsSessionDao;\n\n    @ApiOperation(value = \"认证中心首页\")\n    @RequestMapping(value = \"/index\", method = RequestMethod.GET)\n    public String index(HttpServletRequest request) throws Exception {\n        String appid = request.getParameter(\"appid\");\n        String backurl = request.getParameter(\"backurl\");\n        if (StringUtils.isBlank(appid)) {\n            throw new RuntimeException(\"无效访问！\");\n        }\n        // 判断请求认证系统是否注册\n        UpmsSystemExample upmsSystemExample = new UpmsSystemExample();\n        upmsSystemExample.createCriteria()\n                .andNameEqualTo(appid);\n        int count = upmsSystemService.countByExample(upmsSystemExample);\n        if (0 == count) {\n            throw new RuntimeException(String.format(\"未注册的系统:%s\", appid));\n        }\n        return \"redirect:/sso/login?backurl=\" + URLEncoder.encode(backurl, \"utf-8\");\n    }\n\n    @ApiOperation(value = \"登录\")\n    @RequestMapping(value = \"/login\", method = RequestMethod.GET)\n    public String login(HttpServletRequest request) {\n        Subject subject = SecurityUtils.getSubject();\n        Session session = subject.getSession();\n        String serverSessionId = session.getId().toString();","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/shuzheng/zheng/blob/7005c0a775e6d014d1dc8a8a809f7b1c13bf785a/zheng-upms/zheng-upms-server/src/main/java/com/zheng/upms/server/controller/SSOController.java#L53-L89","documentation":"SSOController.index throws RuntimeException(\"无效访问！\") when the /sso/index request is missing the required appid parameter. The SSO entry point can only identify the calling client system via appid, so a blank value is rejected as an invalid access.","triggerScenarios":"Hitting GET /sso/index without ?appid=..., or with an empty/whitespace appid, e.g. a client app constructing the redirect URL incorrectly or a user bookmarking/opening the SSO page directly.","commonSituations":"Client application forgot to append appid (and backurl) when redirecting to the auth center; URL was truncated or the query string lost in a proxy rewrite; manual testing of the SSO URL without parameters.","solutions":["Make the client app redirect include both appid and backurl: /sso/index?appid=xxx&backurl=yyy.","Verify the appid matches the 'name' of a registered system in the upms_system table.","Check reverse-proxy/rewrite rules are not stripping the query string.","Catch the RuntimeException in a global exception handler and redirect to a friendly error page instead of a stack trace."],"exampleFix":"// before\nString url = ssoServer + \"/sso/index?backurl=\" + backUrl; // appid missing\n// after\nString url = ssoServer + \"/sso/index?appid=\" + appid + \"&backurl=\" + URLEncoder.encode(backUrl, \"utf-8\");","handlingStrategy":"validation","validationCode":"String appid = request.getParameter(\"appid\");\nif (StringUtils.isBlank(appid)) {\n    // reject early / show error page before calling /sso/index\n    return \"redirect:/error?msg=missing-appid\";\n}","typeGuard":"boolean hasValidSsoParams(HttpServletRequest r) {\n    return StringUtils.isNotBlank(r.getParameter(\"appid\"));\n}","tryCatchPattern":"try {\n    return ssoService.initiate(request);\n} catch (RuntimeException e) {\n    if (\"无效访问！\".equals(e.getMessage())) {\n        return \"error/invalid-access\";\n    }\n    throw e;\n}","preventionTips":["Always build SSO redirect URLs with both appid and backurl query parameters.","Centralize SSO URL construction in one helper to avoid missing params.","Add integration tests asserting the client's redirect URL contains appid.","Check proxies/load balancers do not strip query strings.","Render a friendly error page for invalid SSO entries via a @ControllerAdvice handler."],"tags":["sso","http","missing-parameter","request"],"backgroundTag":"missing-request-parameter","analyzedSha":"7005c0a775e6d014d1dc8a8a809f7b1c13bf785a","analyzedAt":"2026-09-04T16:58:32.852Z","contentChangedAt":"2026-09-04T16:58:32.852Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}