dromara/Sa-Token · error · SaSsoException

CODE_30013

CODE_30013

Error message

未能获取应用信息，client={client}

What it means

Thrown by getClientNotNull when a client identifier is present but no matching SaSsoClientModel exists in the server's configured client list. The server only serves requests for registered apps, so an unknown client is rejected before any ticket or redirect processing.

Source

Thrown at sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java:304

    }

    /**
     * 获取应用信息，无效 client 则抛出异常
     *
     * @param client /
     * @return /
     */
    public SaSsoClientModel getClientNotNull(String client) {
        if(SaFoxUtil.isEmpty(client)) {
            if(getConfigOfAllowAnonClient()) {
                return getAnonClient();
            } else {
                throw new SaSsoException("client 标识不可为空");
            }
        } else {
            SaSsoClientModel scm = getClient(client);
            if(scm == null) {
                throw new SaSsoException("未能获取应用信息，client=" + client).setCode(SaSsoErrorCode.CODE_30013);
            }
            return scm;
        }
    }

    /**
     * 获取配置项：是否允许匿名 client 接入
     *
     * @return /
     */
    public boolean getConfigOfAllowAnonClient() {
        return getServerConfig().getAllowAnonClient();
    }

    /**
     * 获取匿名 client 配置信息
     *
     * @return /

View on GitHub (pinned to ac2c7f6e94)

Solutions

  1. Register the client on the sso-server with the exact same identifier the client sends (check for trailing spaces / case)
  2. If clients are configured in yml, verify the list syntax: sa-token.sso.server.clients[0].client, .allow-url, .secret-key etc.
  3. Log the incoming client param at the server's /sso/auth entry to confirm what the client actually sends

Example fix

# application.yml (sso-server)
# before — client 'shop-app' unknown
sa-token:
  sso:
    server:
      clients:
        - client: portal
          allow-url: '*'

# after
sa-token:
  sso:
    server:
      clients:
        - client: portal
          allow-url: '*'
        - client: shop-app
          allow-url: http://shop.example.com/*
Defensive patterns

Strategy: validation

Validate before calling

SaSsoClientModel m = ssoServerTemplate.getClient(client);
if(m == null) {
    // unknown client: fail fast with explicit message before ticket processing
}

Try / catch

try { ssoServerTemplate.getClientNotNull(client); } catch (SaSsoException e) { if(SaSsoErrorCode.CODE_30013 == e.getCode()) { /* reject: unregistered client */ } }

Prevention

When it happens

Trigger: Request carries client=foo but sa-token.sso.server.clients (or the equivalent config/DB registration) has no entry named foo — typo, unregistered app, or stale configuration after an app rename.

Common situations: New client app deployed without being added to the SSO server's client list; client id renamed on the client side only; clients loaded from a database where the row is missing or the query failed silently.

Related errors

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/20968f4ae11f5b96. Report an issue: GitHub.