apolloconfig/apollo · error · AccessDeniedException

Portal user session is required

Error message

Portal user session is required

What it means

Thrown by requirePortalUserRequest when the request's auth type is not a portal user identity (USER or USER_TOKEN).

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java:139

  @Override
  public ResponseEntity<Void> changeUserEnabled(OpenUserDTO openUserDTO, String operator) {
    boolean consumerRequest = requireUserManagementMutationPermission(operator);
    if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()) {
      throw new AccessDeniedException("Change user enabled operation is forbidden");
    }
    UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);
    if (userService instanceof SpringSecurityUserService) {
      ((SpringSecurityUserService) userService).changeEnabled(user);
    } else {
      throw new UnsupportedOperationException("change user enabled is unsupported");
    }
    return ResponseEntity.ok().build();
  }

  private void requirePortalUserRequest() {
    if (!isPortalUserIdentity()) {
      throw new AccessDeniedException("Portal user session is required");
    }
  }

  private void requireUserManagementReadPermission() {
    if (UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {
      return;
    }
    if (UserIdentityConstants.USER_TOKEN.equals(UserIdentityContextHolder.getAuthType())
        && unifiedPermissionValidator.hasManageUsersPermission()) {
      return;
    }
    if (UserIdentityConstants.CONSUMER.equals(UserIdentityContextHolder.getAuthType())
        && unifiedPermissionValidator.hasManageUsersPermission()) {
      return;
    }
    throw new AccessDeniedException("Manage users permission is required");
  }

View on GitHub (pinned to d95fc18d11)

Solutions

1. Authenticate with a portal user session or a user token; consumer tokens are not accepted for this endpoint.
2. Ensure the session cookie or user-token header is sent with the request.

When it happens

Trigger: Thrown when a user-management OpenAPI call that requires an interactive portal session is invoked without a logged-in portal user.

Common situations: Endpoint called with only a consumer token where a portal session is mandatory; session expired or cookie missing.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/ff535c8f037bf39d. Report an issue: GitHub.