dromara/Sa-Token · error · SaSsoException

CODE_30006

CODE_30006

Error message

{result.getMsg()}

What it means

Thrown during SSO single-sign-out on the client side: the client pushed a signout message to the sso-server via pushMessageAsSaResult, and the server's HTTP response did not carry code 200. The exception message is the server's own msg field, so the root cause text comes from the remote server.

Source

Thrown at sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java:284

		// 如果未登录，则无需注销
		if( ! stpLogic.isLogin()) {
			return _ssoLogoutBack(req, res);
		}

		// 向 sso-server 认证中心推送消息：单点注销
		SaLogoutParameter logoutParameter = stpLogic.createSaLogoutParameter();
		if(singleDeviceIdLogout) {
			logoutParameter.setDeviceId(stpLogic.getLoginDeviceId());
		}
		Object loginId = stpLogic.getLoginId();
		Object centerId = ssoClientTemplate.strategy.convertLoginIdToCenterId.run(loginId);
		SaSsoMessage message = ssoClientTemplate.buildSignoutMessage(centerId, logoutParameter);
		SaResult result = ssoClientTemplate.pushMessageAsSaResult(message);

		// 如果 sso-server 响应的状态码非200，代表业务失败，将回应的 msg 字段作为异常抛出
		if(result.getCode() == null || SaResult.CODE_SUCCESS != result.getCode()) {
			throw new SaSsoException(result.getMsg()).setCode(SaSsoErrorCode.CODE_30006);
		}

		// 极端场景下，sso-server 中心的单点注销可能并不会通知到当前 client 端，所以这里需要再补一刀
		if(stpLogic.isLogin()) {
			stpLogic.logout(loginId, logoutParameter);
		}
		return _ssoLogoutBack(req, res);
	}

	/**
	 * 封装：校验ticket，取出loginId，如果 ticket 无效则抛出异常 （适用于模式二或模式三）
	 *
	 * @param ticket ticket码
	 * @return SaCheckTicketResult
	 */
	public SaCheckTicketResult checkTicket(String ticket) {
		return checkTicket(ticket, null);
	}

View on GitHub (pinned to ac2c7f6e94)

Solutions

  1. Check the sso-server logs at the moment of the logout push — the thrown msg is the server-side error reason
  2. Verify sa-token.sso.secret-key (and is-same-token / message signature config) matches on client and server
  3. Confirm the server's sso endpoint URL (sa-token.sso.server-url / api-url) is correct and reachable, not behind an auth filter that returns 401/404
Defensive patterns

Strategy: try-catch

Try / catch

try {
    ssoClientTemplate.ssoLogout(...);
} catch (SaSsoException e) {
    if(SaSsoErrorCode.CODE_30006 == e.getCode()) {
        // server push failed; fall back to local logout so the user is not stuck
        stpLogic.logout(loginId);
    }
}

Prevention

When it happens

Trigger: User logs out on an SSO client; SaSsoClientProcessor builds a signout message and posts it to the sso-server's /sso/signout endpoint; the server returns a non-200 SaResult (e.g. ticket/session invalid, signature failure, server misconfigured) and the client rethrows the server's msg with code CODE_30006.

Common situations: sso-server down or returning an error page (HTML parsed as SaResult); secret-key mismatch between client and server so message checking fails on the server; network/proxy issues returning 404/500; the session already expired on the server.

Related errors

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/00ef27fa2d4c5ad4. Report an issue: GitHub.