{"record":{"id":"cb22f44d3a6a2f91","repo":"dromara/Sa-Token","slug":"11072","errorCode":"11072","errorMessage":"SessionId 不能为空","messagePattern":"SessionId 不能为空","errorType":"exception","errorClass":"SaTokenException","httpStatus":null,"severity":"error","filePath":"sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java","lineNumber":1373,"sourceCode":"\t}\n\n\n\t// ------------------- Account-Session 相关 -------------------\n\n\t/**\n\t * 获取指定 key 的 SaSession, 如果该 SaSession 尚未创建，isCreate = 是否立即新建并返回\n\t *\n\t * @param sessionId SessionId\n\t * @param isCreate 是否新建\n\t * @param timeout 如果这个 SaSession 是新建的，则使用此值作为过期值（单位：秒），可填 null，代表使用全局 timeout 值\n\t * @param appendOperation 如果这个 SaSession 是新建的，则要追加执行的动作，可填 null，代表无追加动作\n\t * @return Session对象\n\t */\n\tpublic SaSession getSessionBySessionId(String sessionId, boolean isCreate, Long timeout, Consumer<SaSession> appendOperation) {\n\n\t\t// 如果提供的 sessionId 为 null，则直接返回 null\n\t\tif(SaFoxUtil.isEmpty(sessionId)) {\n\t\t\tthrow new SaTokenException(\"SessionId 不能为空\").setCode(SaErrorCode.CODE_11072);\n\t\t}\n\n\t\t// 先检查这个 SaSession 是否已经存在，如果不存在且 isCreate=true，则新建并返回\n\t\tSaSession session = getSaTokenDao().getSession(sessionId);\n\n\t\tif(session == null && isCreate) {\n\t\t\t// 创建这个 SaSession\n\t\t\tsession = SaStrategy.instance.createSession.apply(sessionId);\n\n\t\t\t// 追加操作\n\t\t\tif(appendOperation != null) {\n\t\t\t\tappendOperation.accept(session);\n\t\t\t}\n\n\t\t\t// 如果未提供 timeout，则根据相应规则设定默认的 timeout\n\t\t\tif(timeout == null) {\n\t\t\t\t// 如果是 Token-Session，则使用对用 token 的有效期，使 token 和 token-session 保持相同ttl，同步失效\n\t\t\t\tif(SaTokenConsts.SESSION_TYPE__TOKEN.equals(session.getType())) {","sourceCodeStart":1355,"sourceCodeEnd":1391,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java#L1355-L1391","documentation":"Thrown by StpLogic.getSessionBySessionId when the supplied sessionId is null or empty. This is the lowest-level session accessor in sa-token, so it fires before any DAO lookup happens. It signals a caller bug: a required identifier was never resolved before requesting a SaSession.","triggerScenarios":"Calling getSessionBySessionId(null, ...) or getSessionBySessionId(\"\", ...) directly, or indirectly via getSessionByLoginId / getTokenSessionByToken after the underlying loginId/tokenValue evaluated to an empty string (e.g. token read from a missing header, or a null loginId converted with String.valueOf).","commonSituations":"Custom token name or token prefix misconfiguration so getTokenValue() returns empty; calling session APIs inside a filter for anonymous requests; SpEL/template code that renders loginId as 'null' string; upgrading where a caller previously received null instead of an exception.","solutions":["Trace the caller: log the sessionId argument right before the call and find why it is empty (usually an unread token value or unresolved loginId).","If the value comes from a request, validate the token is present first (e.g. check StpUtil.getTokenValue() / isLogin()) before touching sessions.","When the empty value is legitimate in your flow, branch on SaFoxUtil.isEmpty(sessionId) yourself and skip or handle instead of calling the API.","Fix the source of the identifier: correct sa-token token-name/read config so the token is actually resolved."],"exampleFix":"// before\nSaSession session = StpUtil.getSessionBySessionId(rawId, true, null);\n\n// after\nif (SaFoxUtil.isEmpty(rawId)) {\n    // handle missing id explicitly\n    return null;\n}\nSaSession session = StpUtil.getSessionBySessionId(rawId, true, null);","handlingStrategy":"validation","validationCode":"if (SaFoxUtil.isEmpty(sessionId)) {\n    // resolve or reject before calling\n    return;\n}\nSaSession s = stpLogic.getSessionBySessionId(sessionId, isCreate, timeout, null);","typeGuard":null,"tryCatchPattern":"catch (SaTokenException e) when e.getCode() == 11072 — log the caller stack; this is always a caller bug, do not swallow silently.","preventionTips":["Never pass unchecked request-derived values as sessionId","Assert non-empty id in your service layer before session APIs","Enable sa-token debug logging to see which call site produced empty ids"],"tags":["session","validation","stp-logic"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}