{"record":{"id":"b0ba320296ac35f6","repo":"theonedev/onedev","slug":"email-address-with-noreply-domain-is-not-allowed","errorCode":null,"errorMessage":"Email address with noreply domain is not allowed","messagePattern":"Email address with noreply domain is not allowed","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/EmailAddressResource.java","lineNumber":81,"sourceCode":"\tpublic boolean isEmailAddressVerified(@PathParam(\"emailAddressId\") Long emailAddressId) {\n\t\tEmailAddress emailAddress = emailAddressService.load(emailAddressId);\n    \tif (!SecurityUtils.isAdministrator() && !emailAddress.getOwner().equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n    \treturn emailAddress.isVerified();\n\t}\n\t\n\t@Api(order=200, description=\"Create new email address\")\n\t@POST\n\tpublic Long createEmailAddress(@NotNull @Valid EmailAddress emailAddress) {\n\t\tvar owner = emailAddress.getOwner();\n\t\tif (!SecurityUtils.isAdministrator() && !owner.equals(getAuthUser()))\n\t\t\tthrow new UnauthorizedException();\n\t\telse if (owner.isDisabled())\n\t\t\tthrow new NotAcceptableException(\"Cannot set email address for disabled user\");\n\t\telse if (owner.getType() != User.Type.ORDINARY)\n\t\t\tthrow new NotAcceptableException(\"Cannot set email address for service or ai user\");\n\t\telse if (User.getLoginName(emailAddress.getValue()) != null)\n\t\t\tthrow new NotAcceptableException(\"Email address with noreply domain is not allowed\");\n\t\telse if (emailAddressService.findByValue(emailAddress.getValue()) != null)\n\t\t\tthrow new NotAcceptableException(\"This email address is already used by another user\");\n\t\t\n\t\tif (SecurityUtils.isAdministrator()) \n\t\t\temailAddress.setVerificationCode(null);\n\t\t\n\t\temailAddressService.create(emailAddress);\n\n\t\tif (!getAuthUser().equals(owner)) \n\t\t\tauditService.audit(null, \"added email address \\\"\" + emailAddress.getValue() + \"\\\" in account \\\"\" + owner.getName() + \"\\\" via RESTful API\", null, null);\n\t\treturn emailAddress.getId();\n\t}\n\t\n\t@Api(order=250, description=\"Set as primary email address\")\n\t@Path(\"/primary\")\n\t@POST\n\tpublic Long setAsPrimary(@NotNull Long emailAddressId) {\n\t\tvar emailAddress = emailAddressService.load(emailAddressId);","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/EmailAddressResource.java#L63-L99","documentation":"OneDev reserves a noreply mail domain for system-generated addresses; if the submitted email value parses to a login name in that domain (User.getLoginName(value) != null), creation is rejected. Such addresses would collide with the system's noreply naming scheme.","triggerScenarios":"POST an EmailAddress whose value uses the reserved noreply domain (e.g. something@noreply.domain configured for the server).","commonSituations":"Migrating data that includes old noreply-style addresses; tests using example addresses that accidentally match the noreply domain; bulk imports without value validation.","solutions":["Use a real deliverable email domain not matching the noreply domain","Validate the address value client-side against the configured noreply domain before submitting","Sanitize import data to drop noreply-domain addresses"],"exampleFix":"// before\nEmailAddress ea = new EmailAddress();\nea.setValue(\"bot@noreply.example.com\");\n// after\nEmailAddress ea = new EmailAddress();\nea.setValue(\"bot@example.com\");","handlingStrategy":"validation","validationCode":"if (User.getLoginName(value) != null) reject 'noreply domain address';","typeGuard":"boolean usableAddress = User.getLoginName(value) == null;","tryCatchPattern":"try { createEmailAddress(ea); } catch (NotAcceptableException e) { /* noreply domain: use real domain */ }","preventionTips":["Never use the server's noreply domain for user addresses","Validate address domains against the reserved noreply domain before import","Sanitize migrated data"],"tags":["rest-api","email-validation","onedev"],"backgroundTag":"invalid-argument-value","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}