apolloconfig/apollo · error · BadRequestException

add favorite fail. because favorite's user is not current lo

Error message

add favorite fail. because favorite's user is not current login user.

What it means

Thrown as a BadRequestException by FavoriteService.addFavorite() when the favorite's userId does not match the loginUserId. Apollo enforces that a user can only add favorites for themselves — the favorite entity's userId must equal the authenticated user's ID. This is an authorization guard preventing impersonation.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java:55

  private final FavoriteRepository favoriteRepository;
  private final UserService userService;

  public FavoriteService(final FavoriteRepository favoriteRepository,
      final UserService userService) {
    this.favoriteRepository = favoriteRepository;
    this.userService = userService;
  }


  public Favorite addFavorite(Favorite favorite, String loginUserId) {
    UserInfo user = userService.findByUserId(favorite.getUserId());
    if (user == null) {
      throw BadRequestException.userNotExists(favorite.getUserId());
    }

    // user can only add himself favorite app
    if (!Objects.equals(loginUserId, user.getUserId())) {
      throw new BadRequestException(
          "add favorite fail. " + "because favorite's user is not current login user.");
    }

    Favorite checkedFavorite =
        favoriteRepository.findByUserIdAndAppId(loginUserId, favorite.getAppId());
    if (checkedFavorite != null) {
      return checkedFavorite;
    }

    favorite.setPosition(POSITION_DEFAULT);
    favorite.setDataChangeCreatedBy(user.getUserId());
    favorite.setDataChangeLastModifiedBy(user.getUserId());

    return favoriteRepository.save(favorite);
  }


  public List<Favorite> search(String userId, String appId, Pageable page, String loginUserId) {

View on GitHub (pinned to d95fc18d11)

Solutions

Ensure the Favorite object's userId matches the currently authenticated user's ID before calling addFavorite.
On the client side, derive userId from the logged-in session rather than user input.
Verify the loginUserId passed to addFavorite comes from the authenticated principal, not from a request parameter.

Example fix

// before
Favorite fav = new Favorite();
fav.setUserId(request.getParameter("userId"));
fav.setAppId(appId);
favoriteService.addFavorite(fav, loginUserId);
// after - always use the authenticated user's id
Favorite fav = new Favorite();
fav.setUserId(loginUserId);
fav.setAppId(appId);
favoriteService.addFavorite(fav, loginUserId);

Defensive patterns

Strategy: validation

Validate before calling

// Ensure favorite belongs to the current user before adding
if (!Objects.equals(favorite.getUserId(), loginUserId)) {
  throw new IllegalStateException(
    "Cannot add favorite for a different user: " + favorite.getUserId());
}
favoriteService.addFavorite(favorite, loginUserId);

Prevention

Always set the Favorite's userId from the authenticated session, not from user input.
Derive loginUserId from the security context, not from a request parameter.
Add client-side validation to prevent submitting favorites for other users.

When it happens

Trigger: Calling addFavorite with a Favorite object whose userId differs from the loginUserId parameter. For example, a client sets favorite.setUserId('userA') but the authenticated session belongs to 'userB'. The check happens after verifying the user exists.

Common situations: Client-side bug setting the wrong userId on the Favorite object; session/token mismatch where loginUserId is stale or from a different session; attempting to programmatically add favorites on behalf of another user; SSO integration providing inconsistent user IDs.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/84314e4c8b0914fd. Report an issue: GitHub.