apolloconfig/apollo · error · BadRequestException

Current user not found

Error message

Current user not found

What it means

Thrown by AppController.resolveOperator for USER or USER_TOKEN auth types when userInfoHolder.getUser() returns null, or the returned UserInfo has a blank userId. The operator resolver tries to extract the logged-in user's identity to use as the audit operator. If the user context is not populated (session missing, auth filter not running, or userId blank), this fires. Results in HTTP 400.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/AppController.java:270

    }
    if (UserIdentityConstants.CONSUMER.equals(authType)
        && unifiedPermissionValidator.hasCreateApplicationPermission()) {
      return;
    }
    if (UserIdentityConstants.USER_TOKEN.equals(authType)
        && unifiedPermissionValidator.hasCreateApplicationPermission()) {
      return;
    }
    throw new AccessDeniedException("Create application permission is required");
  }

  private String resolveOperator(String operator) {
    String authType = UserIdentityContextHolder.getAuthType();
    if (UserIdentityConstants.USER.equals(authType)
        || UserIdentityConstants.USER_TOKEN.equals(authType)) {
      UserInfo loginUser = userInfoHolder.getUser();
      if (loginUser == null || !StringUtils.hasText(loginUser.getUserId())) {
        throw new BadRequestException("Current user not found");
      }
      return loginUser.getUserId();
    }

    if (UserIdentityConstants.CONSUMER.equals(authType)) {
      if (!StringUtils.hasText(operator)) {
        throw new BadRequestException("operator should not be null or empty");
      }
      if (userService.findByUserId(operator) == null) {
        throw BadRequestException.userNotExists(operator);
      }
      return operator;
    }

    throw new BadRequestException("Unsupported auth type: %s", authType);
  }

  private void validatePortalApp(OpenAppDTO app) {

View on GitHub (pinned to d95fc18d11)

Solutions

1. Ensure the request goes through the proper authentication filter that populates UserInfoHolder with a valid UserInfo.
2. Verify the user account still exists in the user service (e.g., LDAP/DB) and has a non-blank userId.
3. Check Spring Security filter chain ordering — the UserInfoHolder must be set before the controller method executes.
4. For testing, mock userInfoHolder.getUser() to return a UserInfo with a valid userId.

// Verify user context is populated before calling resolveOperator-dependent methods
String authType = UserIdentityContextHolder.getAuthType();
if (UserIdentityConstants.USER.equals(authType) || UserIdentityConstants.USER_TOKEN.equals(authType)) {
    UserInfo user = userInfoHolder.getUser();
    if (user == null || !StringUtils.hasText(user.getUserId())) {
        throw new IllegalStateException(
            "User context not populated. Ensure the auth filter ran for this request.");
    }
}

When it happens

Trigger: An API request authenticated as USER or USER_TOKEN reaches a controller method that calls resolveOperator, but the UserInfoHolder has no user (null) or a UserInfo with an empty userId. This typically means the Spring Security context or a custom auth filter failed to populate the UserInfoHolder.

Common situations: A security filter or interceptor that populates UserInfoHolder was skipped (wrong filter order, or the endpoint is not behind the expected security chain). A user-token is technically valid but the user record was deleted from the user service, so getUser() returns null. A misconfigured integration where resolveOperator is called outside a properly authenticated request.

Related errors

• operator should not be null or empty
• Token is Illegal
• operator should not be null or empty
• Unsupported auth type: %s
• Current user not found

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/591364211636415a. Report an issue: GitHub.