apolloconfig/apollo · error · BadRequestException

can not operate other person's favorite

Error message

can not operate other person's favorite

What it means

Thrown as a BadRequestException by FavoriteService.checkUserOperatePermission() when the favorite exists but its userId does not match the loginUserId. This is an ownership check: only the user who created a favorite can modify or delete it. The check is separate from the null check (error 193) and fires only for favorites that exist but belong to someone else.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java:132

    checkUserOperatePermission(favorite, loginUserId);

    String userId = favorite.getUserId();
    Favorite firstFavorite =
        favoriteRepository.findFirstByUserIdOrderByPositionAscDataChangeCreatedTimeAsc(userId);
    long minPosition = firstFavorite.getPosition();

    favorite.setPosition(minPosition - 1);

    favoriteRepository.save(favorite);
  }

  private void checkUserOperatePermission(Favorite favorite, String loginUserId) {
    if (favorite == null) {
      throw new BadRequestException("favorite not exist");
    }

    if (!Objects.equals(loginUserId, favorite.getUserId())) {
      throw new BadRequestException("can not operate other person's favorite");
    }
  }

  public void batchDeleteByAppId(String appId, String operator) {
    favoriteRepository.batchDeleteByAppId(appId, operator);
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

1. Ensure the client only operates on favorites belonging to the current user by filtering the favorites list by userId.
2. Verify the loginUserId in the session matches the favorite's owner before performing operations.
3. If admin operations on other users' favorites are needed, implement a separate admin-authorized endpoint.
4. Refresh the favorites list to confirm ownership before attempting modify/delete.

// Verify ownership before operating on a favorite
Favorite favorite = favoriteRepository.findById(favoriteId).orElse(null);
if (favorite == null) {
  throw new IllegalArgumentException("Favorite not found");
}
if (!Objects.equals(favorite.getUserId(), loginUserId)) {
  throw new SecurityException("Not authorized to operate on this favorite");
}

When it happens

Trigger: Calling an operation (delete, adjust position) on a favorite whose userId differs from the authenticated loginUserId. For example, userA tries to delete userB's favorite by guessing or enumerating the favorite ID.

Common situations: Client-side bug passing the wrong favorite ID; attempt to operate on another user's favorite; session mismatch where loginUserId is incorrect; shared bookmark/favorite ID across users in a multi-tenant confusion.

Related errors

• add favorite fail. because favorite's user is not current lo
• user id and app id can't be empty at the same time
• favorite not exist
• User token operation is not allowed:%s
• create namespace failed for: %s

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/1da6355fee1aff2a. Report an issue: GitHub.