apolloconfig/apollo · error · BadRequestException

Current user not found

Error message

Current user not found

What it means

HTTP 400 (BadRequestException). Thrown by NamespaceBranchController.resolveOperator when the auth type is USER or USER_TOKEN but UserInfoHolder.getUser() returns null or a UserInfo with a blank userId. The operator is normally derived from the authenticated principal, so this indicates the security context/principal was not populated correctly for a portal or user-token request.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/NamespaceBranchController.java:271

  }

  private void checkEmergencyPublishAllowedForUser(String env, boolean emergencyPublish) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (emergencyPublish
        && (UserIdentityConstants.USER.equals(authType)
            || UserIdentityConstants.USER_TOKEN.equals(authType))
        && !portalConfig.isEmergencyPublishAllowed(Env.valueOf(env))) {
      throw new BadRequestException("Env: %s is not supported emergency publish now", env);
    }
  }

  private String resolveOperator(String queryOperator, String payloadOperator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || StringUtils.isBlank(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      String operator = StringUtils.isBlank(queryOperator) ? payloadOperator : queryOperator;
      RequestPrecondition.checkArguments(!StringUtils.isContainEmpty(operator),
          "operator should not be null or empty");
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }

  private boolean shouldHideConfigToCurrentUser(String appId, String env, String clusterName,

View on GitHub (pinned to d95fc18d11)

Solutions

  1. Re-authenticate: obtain a fresh portal session / user token and retry.
  2. Verify the auth integration populates UserInfoHolder with a non-blank userId for USER/USER_TOKEN requests.
  3. If calling as an OpenAPI consumer, authenticate as CONSUMER and supply an explicit operator instead.
  4. Check the security filter chain ordering so the principal is set before the controller runs.

Example fix

// before: USER_TOKEN auth but principal missing
UserInfo user = userInfoHolder.getUser(); // null -> 400

// after: ensure auth filter sets the principal
if (user == null || StringUtils.isBlank(user.getUserId())) {
    // re-auth or 401 before reaching resolveOperator
}
// or switch to CONSUMER auth and pass operator explicitly
Defensive patterns

Strategy: try-catch

Validate before calling

// For USER/USER_TOKEN: ensure principal exists before any write.
UserInfo u = userInfoHolder != null ? userInfoHolder.getUser() : null;
if (u == null || StringUtils.isBlank(u.getUserId())) {
  // re-authenticate; do not proceed to resolveOperator
}

Type guard

null

Try / catch

try {
  client.createBranch(appId, env, cluster, ns, operator);
} catch (HttpClientErrorException.BadRequest e) {
  if (e.getResponseBodyAsString().contains("Current user not found")) {
    refreshToken(); client.createBranch(appId, env, cluster, ns, operator);
  }
}

Prevention

When it happens

Trigger: Any NamespaceBranch write/create/delete API call authenticated as USER or USER_TOKEN where the request reached the controller without a populated Spring Security principal — e.g. a misconfigured security filter chain, a user-token that authenticated but did not resolve to a UserInfo, or a session that expired mid-request.

Common situations: Portal SSO session expired between auth and controller invocation; a custom auth integration that sets authType=USER but forgets to populate UserInfoHolder; user-token with a corrupt/empty subject; running behind a gateway that strips the auth header.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/e2f1e290ddf338ce. Report an issue: GitHub.