dromara/Sa-Token · error · SaSsoException

client 标识不可为空

Error message

client 标识不可为空

What it means

Thrown by SaSsoServerTemplate.getClientNotNull when the client parameter is empty and anonymous-client access is not enabled (allow-anon-client=false, the default). The server needs a client identifier to load the app's allow-url and sign-key configuration; without it and without the anon escape hatch, it refuses the request.

Source

Thrown at sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java:299

     * @param client /
     * @return /
     */
    public SaSsoClientModel getClient(String client) {
        return getServerConfig().getClients().get(client);
    }

    /**
     * 获取应用信息，无效 client 则抛出异常
     *
     * @param client /
     * @return /
     */
    public SaSsoClientModel getClientNotNull(String client) {
        if(SaFoxUtil.isEmpty(client)) {
            if(getConfigOfAllowAnonClient()) {
                return getAnonClient();
            } else {
                throw new SaSsoException("client 标识不可为空");
            }
        } else {
            SaSsoClientModel scm = getClient(client);
            if(scm == null) {
                throw new SaSsoException("未能获取应用信息，client=" + client).setCode(SaSsoErrorCode.CODE_30013);
            }
            return scm;
        }
    }

    /**
     * 获取配置项：是否允许匿名 client 接入
     *
     * @return /
     */
    public boolean getConfigOfAllowAnonClient() {
        return getServerConfig().getAllowAnonClient();
    }

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Have the client send its identifier (client query param / configured client id) on every SSO request
2. Or enable anonymous client access on the server: sa-token.sso.allow-anon-client=true, which substitutes a default anonymous client model

Example fix

# application.yml (sso-server)
# before
sa-token:
  sso: {}

# after
sa-token:
  sso:
    allow-anon-client: true

String client = req.getParam(paramName.client);
if(SaFoxUtil.isEmpty(client) && !cfg.getAllowAnonClient()) {
    // reject early with a clear 400 instead of deep exception
}

When it happens

Trigger: A request to /sso/auth or a ticket/check call omits the client parameter while getAllowAnonClient() returns false.

Common situations: Older client apps or sa-token versions that never send a client parameter; a redirect URL that drops query parameters; server operator unaware that multi-client mode requires either per-request client ids or the anon switch.

Related errors

• CODE_30013
• CODE_30014
• CODE_30015
• 10004
• CODE_30022

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/259353293e333767. Report an issue: GitHub.