apolloconfig/apollo · warning · BadRequestException

Username and password can not be empty.

Error message

Username and password can not be empty.

What it means

Thrown by UserInfoController.createOrUpdateUser (POST /users) when StringUtils.isContainEmpty(username, password) is true, i.e. the request body's UserPO has a blank username or password. It is a BadRequestException mapped to HTTP 400. Note this legacy controller is @Deprecated in favor of /openapi/v1 endpoints.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java:72

  private final AuthUserPasswordChecker passwordChecker;
  private final UnifiedPermissionValidator unifiedPermissionValidator;

  public UserInfoController(final UserInfoHolder userInfoHolder, final LogoutHandler logoutHandler,
      final UserService userService, final AuthUserPasswordChecker passwordChecker,
      UnifiedPermissionValidator unifiedPermissionValidator) {
    this.userInfoHolder = userInfoHolder;
    this.logoutHandler = logoutHandler;
    this.userService = userService;
    this.passwordChecker = passwordChecker;
    this.unifiedPermissionValidator = unifiedPermissionValidator;
  }

  @PostMapping("/users")
  public void createOrUpdateUser(
      @RequestParam(value = "isCreate", defaultValue = "false") boolean isCreate,
      @RequestBody UserPO user) {
    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
      throw new BadRequestException("Username and password can not be empty.");
    }

    if (!unifiedPermissionValidator.isSuperAdmin()
        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())
            || user.getEnabled() != USER_ENABLED)) {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }

    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());
    if (!pwdCheckRes.isSuccess()) {
      throw new BadRequestException(pwdCheckRes.getMessage());
    }

    if (userService instanceof SpringSecurityUserService) {
      if (isCreate) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);

View on GitHub (pinned to d95fc18d11)

Solutions

1. Ensure both username and password are non-blank in the request body before POSTing.
2. Add client-side validation: reject empty username/password before the call.
3. Verify the JSON field names exactly match UserPO.getUsername()/getPassword() (username, password).
4. Migrate to the /openapi/v1 user endpoints if building new integrations; this controller is deprecated.

Example fix

// before
UserPO u = new UserPO();
u.setUsername("alice");
postUsers(u, true);

// after
if (StringUtils.isContainEmpty(u.getUsername(), u.getPassword())) {
  throw new IllegalStateException("username and password are required client-side");
}
postUsers(u, true);

if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
  return ResponseEntity.badRequest().body("username and password are required");
}

boolean isCreatableUser(UserPO u) { return u != null && !StringUtils.isContainEmpty(u.getUsername(), u.getPassword()); }

When it happens

Trigger: POST /users with isCreate flag and a UserPO body whose username or password field is null/empty/whitespace-only. Common when the client omits a field or sends an empty string.

Common situations: Frontend form submitting before validation; API client serializing a partially-populated DTO; integration test that forgets to set the password; JSON field-name mismatch (e.g. pass vs password) silently leaving the field null.

Related errors

• Password needs a number and letter and between 8~20 characte
• userIds should not be null or empty
• operator should not be null or empty
• ConsumerApp not exist
• App is null

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/81fbe0cf868878d3. Report an issue: GitHub.