apolloconfig/apollo · warning · BadRequestException

Passwords cannot be consecutive, regular letters or numbers.

Error message

Passwords cannot be consecutive, regular letters or numbers. And cannot be commonly used. e.g: abcd1234, 1234qwer, 1q2w3e4r, 1234asdfghjk, ...

What it means

Surfaced via UserInfoController.createOrUpdateUser from AuthUserPasswordChecker.checkWeakPassword when the password passes the length/charset regex but is flagged as commonly-used: it contains (case-insensitive) a substring listed in portalConfig.getUserPasswordNotAllowList(). Returned as BadRequestException (HTTP 400).

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java:83

  }

  @PostMapping("/users")
  public void createOrUpdateUser(
      @RequestParam(value = "isCreate", defaultValue = "false") boolean isCreate,
      @RequestBody UserPO user) {
    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
      throw new BadRequestException("Username and password can not be empty.");
    }

    if (!unifiedPermissionValidator.isSuperAdmin()
        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())
            || user.getEnabled() != USER_ENABLED)) {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }

    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());
    if (!pwdCheckRes.isSuccess()) {
      throw new BadRequestException(pwdCheckRes.getMessage());
    }

    if (userService instanceof SpringSecurityUserService) {
      if (isCreate) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);
      }
    } else {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }
  }

  @PreAuthorize(value = "@unifiedPermissionValidator.isSuperAdmin()")
  @PutMapping("/users/enabled")
  public void changeUserEnabled(@RequestBody UserPO user) {
    if (userService instanceof SpringSecurityUserService) {
      ((SpringSecurityUserService) userService).changeEnabled(user);

View on GitHub (pinned to d95fc18d11)

Solutions

1. Pick a non-dictionary, non-sequential password that contains none of the blocked substrings.
2. Review portalConfig.getUserPasswordNotAllowList() (the blocked-fragments list) to learn which patterns are rejected.
3. Regenerate programmatically with a strong random generator and verify it is not on the blocklist.

Example fix

// before
String pwd = "abcd1234"; // blocked

// after
String pwd = randomAlnum(16); // verify none of portalConfig.getUserPasswordNotAllowList() is a substring
boolean blocked = notAllowList.stream().anyMatch(pwd.toLowerCase()::contains);
if (blocked) { pwd = regenerate(); }

List<String> blocked = portalConfig.getUserPasswordNotAllowList();
String lower = password.toLowerCase();
if (blocked != null && blocked.stream().anyMatch(lower::contains)) {
  return ResponseEntity.badRequest().body("password is on the commonly-used blocklist");
}

boolean isWeakPassword(String p, List<String> blocklist) {
  String l = p == null ? "" : p.toLowerCase();
  return blocklist != null && blocklist.stream().anyMatch(l::contains);
}

When it happens

Trigger: POST /users with a password such as abcd1234, 1234qwer, 1q2w3e4r — any value whose lowercase form contains an entry from the configured not-allow list.

Common situations: Operator uses a well-known weak password; the not-allow list (portal config) was extended to block patterns present in an existing user's chosen password; CI seeded users with a predictable default password.

Related errors

• Password needs a number and letter and between 8~20 characte
• userIds should not be null or empty
• operator should not be null or empty
• ConsumerApp not exist
• App is null

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/45caf8bf14bd8ef7. Report an issue: GitHub.