{"record":{"id":"a3bf3c74728c3ffd","repo":"alibaba/spring-ai-alibaba","slug":"invalid-params-a3bf3c","errorCode":"INVALID_PARAMS","errorMessage":"username","messagePattern":"username","errorType":"validation","errorClass":"BizException","httpStatus":null,"severity":"error","filePath":"spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-start/src/main/java/com/alibaba/cloud/ai/studio/admin/builder/controller/AuthController.java","lineNumber":58,"sourceCode":" */\n@RestController\n@Tag(name = \"auth\")\n@RequestMapping(\"/console/v1/auth\")\n@RequiredArgsConstructor\npublic class AuthController {\n\n\t/** Account service for handling authentication operations */\n\tprivate final AccountService accountService;\n\n\t/**\n\t * Authenticates user and returns access tokens.\n\t * @param loginRequest User credentials\n\t * @return Access and refresh tokens\n\t */\n\t@PostMapping(\"/login\")\n\tpublic Result<TokenResponse> login(@RequestBody LoginRequest loginRequest) {\n\t\tif (StringUtils.isBlank(loginRequest.getUsername())) {\n\t\t\tthrow new BizException(ErrorCode.INVALID_PARAMS.toError(\"username\"));\n\t\t}\n\n\t\tif (StringUtils.isBlank(loginRequest.getPassword())) {\n\t\t\tthrow new BizException(ErrorCode.INVALID_PARAMS.toError(\"password\"));\n\t\t}\n\n\t\tTokenResponse response = accountService.login(loginRequest);\n\t\treturn Result.success(IdGenerator.uuid(), response);\n\t}\n\n\t/**\n\t * Refreshes access token using refresh token.\n\t * @param request Refresh token request\n\t * @return New access and refresh tokens\n\t */\n\t@PostMapping(\"/refresh-token\")\n\tpublic Result<TokenResponse> refreshToken(@RequestBody RefreshTokenRequest request) {\n\t\tif (StringUtils.isBlank(request.getRefreshToken())) {","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/alibaba/spring-ai-alibaba/blob/f82da0b50f35744c13968191be2b1cd2452ef550/spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-start/src/main/java/com/alibaba/cloud/ai/studio/admin/builder/controller/AuthController.java#L40-L76","documentation":"BizException with ErrorCode.INVALID_PARAMS thrown by AuthController.login when loginRequest.getUsername() is blank (null or whitespace). Login requires both username and password to issue an access/refresh TokenResponse; a blank username is rejected with INVALID_PARAMS before credential checking.","triggerScenarios":"POST to the auth login endpoint with a JSON body whose username field is null, absent, empty, or whitespace-only (e.g. {\"username\":\"\",\"password\":\"x\"}).","commonSituations":"Login forms submitted with the username field empty; clients omitting the username property in the JSON payload; trimming issues where input is only spaces; front-end state not synced before submit.","solutions":["Send a non-blank username in the JSON body along with the password.","Add client-side validation requiring a non-empty username before submitting the login form.","Ensure Content-Type: application/json and that the body actually deserializes into LoginRequest (field name must match 'username').","If credentials come from env/config, verify the username variable is populated and not empty."],"exampleFix":"// before\nPOST /auth/login\n{\"username\": \"\", \"password\": \"secret\"}\n// after\nPOST /auth/login\n{\"username\": \"admin\", \"password\": \"secret\"}","handlingStrategy":"validation","validationCode":"if (loginRequest == null || loginRequest.getUsername() == null || loginRequest.getUsername().isBlank()) { throw new IllegalArgumentException(\"username is required\"); }","typeGuard":"boolean hasUsername(LoginRequest r) { return r != null && r.getUsername() != null && !r.getUsername().isBlank(); }","tryCatchPattern":"try { api.login(loginRequest); } catch (BizException e) { if (e.getMessage().contains(\"username\")) { /* surface field-level error to the login form */ } }","preventionTips":["Require both username and password fields in the login UI before submit.","Trim and check input is non-blank, not just non-empty.","Confirm credentials from env/config are actually set before automated login calls.","Match the JSON property names to LoginRequest fields so deserialization does not yield nulls."],"tags":["auth","validation","empty-field","login"],"backgroundTag":"empty-required-field","analyzedSha":"f82da0b50f35744c13968191be2b1cd2452ef550","analyzedAt":"2026-09-09T15:32:42.421Z","contentChangedAt":"2026-09-09T15:32:42.421Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}