What causes "user id and app id can't be empty at the same time" in apolloconfig/apollo?

Provide at least one of userId or appId as a non-empty query parameter when calling search.

apolloconfig/apollo · warning · BadRequestException

user id and app id can't be empty at the same time

Error message

user id and app id can't be empty at the same time

What it means

Thrown as a BadRequestException by FavoriteService.search() when both userId and appId parameters are null or empty. The search requires at least one filter criterion to prevent unbounded queries. Strings.isNullOrEmpty is used for both, and if both are blank the exception fires before any repository call.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/FavoriteService.java:78

        favoriteRepository.findByUserIdAndAppId(loginUserId, favorite.getAppId());
    if (checkedFavorite != null) {
      return checkedFavorite;
    }

    favorite.setPosition(POSITION_DEFAULT);
    favorite.setDataChangeCreatedBy(user.getUserId());
    favorite.setDataChangeLastModifiedBy(user.getUserId());

    return favoriteRepository.save(favorite);
  }


  public List<Favorite> search(String userId, String appId, Pageable page, String loginUserId) {
    boolean isUserIdEmpty = Strings.isNullOrEmpty(userId);
    boolean isAppIdEmpty = Strings.isNullOrEmpty(appId);

    if (isAppIdEmpty && isUserIdEmpty) {
      throw new BadRequestException("user id and app id can't be empty at the same time");
    }

    if (!isUserIdEmpty) {
      // user can only search his own favorite app
      if (!Objects.equals(loginUserId, userId)) {
        userId = loginUserId;
      }
    }

    // search by userId
    if (isAppIdEmpty) {
      return favoriteRepository.findByUserIdOrderByPositionAscDataChangeCreatedTimeAsc(userId,
          page);
    }

    // search by appId
    if (isUserIdEmpty) {
      return favoriteRepository.findByAppIdOrderByPositionAscDataChangeCreatedTimeAsc(appId, page);

View on GitHub (pinned to d95fc18d11)

Solutions

Provide at least one of userId or appId as a non-empty query parameter when calling search.
Add client-side validation to require at least one search criterion before making the API call.
If listing all favorites is needed for admin purposes, use a dedicated admin endpoint instead of search.

Example fix

// before
List<Favorite> results = favoriteService.search(null, null, page, loginUserId);
// after
if (Strings.isNullOrEmpty(userId) && Strings.isNullOrEmpty(appId)) {
  throw new IllegalArgumentException("Provide userId or appId to search");
}
List<Favorite> results = favoriteService.search(userId, appId, page, loginUserId);

Defensive patterns

Strategy: validation

Validate before calling

// Validate at least one filter is provided before searching
if ((userId == null || userId.trim().isEmpty()) && (appId == null || appId.trim().isEmpty())) {
  throw new IllegalArgumentException("At least one of userId or appId must be provided");
}
favoriteService.search(userId, appId, page, loginUserId);

Prevention

Add client-side validation requiring at least one search criterion.
Default to searching by the current user's userId if no filter is provided.
Document the API requirement that at least one filter is mandatory.

When it happens

Trigger: Calling the favorite search API with neither a userId nor an appId query parameter. For example, GET /favorites with no query parameters, or both parameters set to empty strings.

Common situations: Client sends a search request without any filter; UI search form submitted empty; API client misconfigured to not pass required filters; frontend bug not validating input before the API call.

Related errors

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/dd3bca58b949977a. Report an issue: GitHub.