{"record":{"id":"fbbcd8473acd621a","repo":"pinpoint-apm/pinpoint","slug":"there-is-not-userid-in-params-to-delete-user","errorCode":null,"errorMessage":"there is not userId in params to delete user","messagePattern":"there is not userId in params to delete user","errorType":"http","errorClass":"ResponseStatusException","httpStatus":400,"severity":"error","filePath":"web/src/main/java/com/navercorp/pinpoint/web/authorization/controller/UserController.java","lineNumber":77,"sourceCode":"\n    @PreAuthorize(\"hasPermission(null, null, T(com.navercorp.pinpoint.web.security.PermissionChecker).PERMISSION_ADMINISTRATION_EDIT_USER)\")\n    @PostMapping\n    public Response insertUser(@RequestBody User user) {\n        if (!ValueValidator.validateUser(user)) {\n            throw new ResponseStatusException(\n                    HttpStatus.BAD_REQUEST,\n                    \"User information validation failed to creating user information.\"\n            );\n        }\n        userService.insertUser(user);\n        return SimpleResponse.ok();\n    }\n\n    @PreAuthorize(\"hasPermission(null, null, T(com.navercorp.pinpoint.web.security.PermissionChecker).PERMISSION_ADMINISTRATION_EDIT_USER)\")\n    @DeleteMapping\n    public Response deleteUser(@RequestBody User user) {\n        if (StringUtils.isEmpty(user.getUserId())) {\n            throw new ResponseStatusException(\n                    HttpStatus.BAD_REQUEST,\n                    \"there is not userId in params to delete user\"\n            );\n        }\n        userService.deleteUser(user.getUserId());\n        return SimpleResponse.ok();\n    }\n\n    @GetMapping(params = \"userId\")\n    public List<User> getUserByUserId(@RequestParam(\"userId\") @NotBlank String userId) {\n        try {\n            final User user = userService.selectUserByUserId(userId);\n            return List.of(user);\n        } catch (Exception e) {\n            logger.error(\"Cannot select user\", e);\n            throw new ResponseStatusException(\n                    HttpStatus.INTERNAL_SERVER_ERROR,\n                    \"This api need to collect condition for search.\"","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/web/src/main/java/com/navercorp/pinpoint/web/authorization/controller/UserController.java#L59-L95","documentation":"UserController's DELETE /user requires a User body whose userId is non-empty; when StringUtils.isEmpty(user.getUserId()) it throws a 400 ResponseStatusException and no deletion happens. This guards against deleting based on an unspecified user.","triggerScenarios":"DELETE /user with an empty JSON body, a body lacking the userId field, or a body where userId is null/blank.","commonSituations":"Scripts calling DELETE with an empty object {}; assuming userId is passed as a query parameter instead of in the JSON body; UI sending the whole user object after the field was renamed.","solutions":["Include the target userId in the JSON request body: {\"userId\":\"someuser\"}","Verify the client actually reads the user's id before issuing the delete (no stale/blank selection)","If deleting by name or other attribute, resolve the userId first via GET /user","Confirm Content-Type is application/json so the body deserializes into User"],"exampleFix":"// before\naxios.delete('/user', {})\n// after\naxios.delete('/user', { data: { userId: 'alice' } })","handlingStrategy":"validation","validationCode":"// Ensure userId present before DELETE /user\nif (!user || !user.userId) {\n  throw new Error('deleteUser requires a non-empty userId');\n}","typeGuard":"function hasUserId(u) {\n  return typeof u === 'object' && u !== null && typeof u.userId === 'string' && u.userId.length > 0;\n}","tryCatchPattern":"try {\n  await axios.delete('/user', { data: { userId } });\n} catch (e) {\n  if (e.response && e.response.status === 400) {\n    console.error('userId missing in delete request body');\n  }\n  throw e;\n}","preventionTips":["Always pass userId in the DELETE request body, not query params","Resolve the userId via GET /user before deleting","Guard client code against blank selections in UI bulk-delete flows"],"tags":["http-400","missing-parameter","rest-api","user-management"],"backgroundTag":"missing-required-argument","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}