apolloconfig/apollo · error · BadRequestException

Username and password can not be empty.

Error message

Username and password can not be empty.

What it means

Thrown by createOrUpdateUser when the converted user has an empty username or password. StringUtils.isContainEmpty treats null, empty, and whitespace-only values as empty.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java:96

  }

  @Override
  public ResponseEntity<OpenUserInfoDTO> getUserByUserId(String userId) {
    requireUserManagementReadPermission();
    UserInfo user = userService.findByUserId(userId);
    if (user == null) {
      throw BadRequestException.userNotExists(userId);
    }
    return ResponseEntity.ok(OpenApiModelConverters.fromUserInfo(user));
  }

  @Override
  public ResponseEntity<Void> createOrUpdateUser(OpenUserDTO openUserDTO, Boolean isCreate,
      String operator) {
    boolean consumerRequest = requireUserManagementMutationPermission(operator);
    UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);
    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
      throw new BadRequestException("Username and password can not be empty.");
    }

    if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()
        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())
            || user.getEnabled() != USER_ENABLED)) {
      throw new AccessDeniedException("Create or update user operation is forbidden");
    }

    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());
    if (!pwdCheckRes.isSuccess()) {
      throw new BadRequestException(pwdCheckRes.getMessage());
    }

    if (userService instanceof SpringSecurityUserService) {
      if (Boolean.TRUE.equals(isCreate)) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);

View on GitHub (pinned to d95fc18d11)

Solutions

1. Provide both username and password in the OpenUserDTO payload; neither may be null, empty, or whitespace.
2. Verify the request body is serialized correctly and the fields map to username/password as defined by the OpenAPI spec.

When it happens

Trigger: Thrown when the create-or-update user OpenAPI endpoint is called with a blank username or blank password in the request body.

Common situations: Client omitted username/password fields; empty strings sent in the JSON payload.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/f7289ec0a20aa3c3. Report an issue: GitHub.