dromara/Sa-Token · error · SaTokenException

11072

11072

Error message

SessionId 不能为空

What it means

Thrown by StpLogic.getSessionBySessionId when the supplied sessionId is null or empty. This is the lowest-level session accessor in sa-token, so it fires before any DAO lookup happens. It signals a caller bug: a required identifier was never resolved before requesting a SaSession.

Source

Thrown at sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java:1373

	}


	// ------------------- Account-Session 相关 -------------------

	/**
	 * 获取指定 key 的 SaSession, 如果该 SaSession 尚未创建，isCreate = 是否立即新建并返回
	 *
	 * @param sessionId SessionId
	 * @param isCreate 是否新建
	 * @param timeout 如果这个 SaSession 是新建的，则使用此值作为过期值（单位：秒），可填 null，代表使用全局 timeout 值
	 * @param appendOperation 如果这个 SaSession 是新建的，则要追加执行的动作，可填 null，代表无追加动作
	 * @return Session对象
	 */
	public SaSession getSessionBySessionId(String sessionId, boolean isCreate, Long timeout, Consumer<SaSession> appendOperation) {

		// 如果提供的 sessionId 为 null，则直接返回 null
		if(SaFoxUtil.isEmpty(sessionId)) {
			throw new SaTokenException("SessionId 不能为空").setCode(SaErrorCode.CODE_11072);
		}

		// 先检查这个 SaSession 是否已经存在，如果不存在且 isCreate=true，则新建并返回
		SaSession session = getSaTokenDao().getSession(sessionId);

		if(session == null && isCreate) {
			// 创建这个 SaSession
			session = SaStrategy.instance.createSession.apply(sessionId);

			// 追加操作
			if(appendOperation != null) {
				appendOperation.accept(session);
			}

			// 如果未提供 timeout，则根据相应规则设定默认的 timeout
			if(timeout == null) {
				// 如果是 Token-Session，则使用对用 token 的有效期，使 token 和 token-session 保持相同ttl，同步失效
				if(SaTokenConsts.SESSION_TYPE__TOKEN.equals(session.getType())) {

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Trace the caller: log the sessionId argument right before the call and find why it is empty (usually an unread token value or unresolved loginId).
2. If the value comes from a request, validate the token is present first (e.g. check StpUtil.getTokenValue() / isLogin()) before touching sessions.
3. When the empty value is legitimate in your flow, branch on SaFoxUtil.isEmpty(sessionId) yourself and skip or handle instead of calling the API.
4. Fix the source of the identifier: correct sa-token token-name/read config so the token is actually resolved.

Example fix

// before
SaSession session = StpUtil.getSessionBySessionId(rawId, true, null);

// after
if (SaFoxUtil.isEmpty(rawId)) {
    // handle missing id explicitly
    return null;
}
SaSession session = StpUtil.getSessionBySessionId(rawId, true, null);

if (SaFoxUtil.isEmpty(sessionId)) {
    // resolve or reject before calling
    return;
}
SaSession s = stpLogic.getSessionBySessionId(sessionId, isCreate, timeout, null);

catch (SaTokenException e) when e.getCode() == 11072 — log the caller stack; this is always a caller bug, do not swallow silently.

When it happens

Trigger: Calling getSessionBySessionId(null, ...) or getSessionBySessionId("", ...) directly, or indirectly via getSessionByLoginId / getTokenSessionByToken after the underlying loginId/tokenValue evaluated to an empty string (e.g. token read from a missing header, or a null loginId converted with String.valueOf).

Common situations: Custom token name or token prefix misconfiguration so getTokenValue() returns empty; calling session APIs inside a filter for anonymous requests; SpEL/template code that renders loginId as 'null' string; upgrading where a caller previously received null instead of an exception.

Related errors

• Account-Session 获取失败：loginId 不能为空
• 30104
• 12002
• 12003
• 12001

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/cb22f44d3a6a2f91. Report an issue: GitHub.