dromara/Sa-Token · warning · ApiDisabledException

CODE_30302

CODE_30302

Error message

jwt cannot delete token

What it means

ApiDisabledException from SaTempTemplateForJwt.deleteToken: the JWT-backed temp-token implementation is stateless, so tokens cannot be revoked or deleted — there is no storage backing them. Calling the inherited delete API is a category error for this implementation.

Source

Thrown at sa-token-plugin/sa-token-temp-jwt/src/main/java/cn/dev33/satoken/temp/jwt/SaTempTemplateForJwt.java:64

	@Override
	public Object parseToken(String token) {
		return SaJwtUtil.getValue(token, getJwtSecretKey());
	}
	
	/**
	 * 返回指定token的剩余有效期，单位：秒 
	 */
	@Override
	public long getTimeout(String token) {
		return SaJwtUtil.getTimeout(token, getJwtSecretKey());
	}

	/**
	 * 删除一个token
	 */
	@Override
	public void deleteToken(String token) {
		throw new ApiDisabledException("jwt cannot delete token").setCode(SaTempJwtErrorCode.CODE_30302);
	}

	/**
	 * 获取指定 value 的 temp-token 列表记录
	 * @param value /
	 * @return /
	 */
	public List<String> getTempTokenList(Object value) {
		throw new ApiDisabledException("jwt cannot get token list").setCode(SaTempJwtErrorCode.CODE_30304);
	}

	/**
	 * 获取jwt秘钥 
	 * @return jwt秘钥 
	 */
	@Override
	public String getJwtSecretKey() {
		String jwtSecretKey = SaManager.getConfig().getJwtSecretKey();

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Remove the deleteToken call — rely on short token timeouts instead of revocation
2. If revocation is a hard requirement, switch to the storage-backed temp token (SaTempDefaultImpl) rather than JWT
3. Guard shared code paths with an instanceof check before calling delete APIs

Example fix

// before
saTempTemplate.deleteToken(token); // ApiDisabledException under jwt impl

// after
if(saTempTemplate instanceof SaTempTemplateForJwt) {
    // stateless: nothing to delete, just wait for expiry
} else {
    saTempTemplate.deleteToken(token);
}

boolean isStatelessJwtTemp = SaManager.getSaTempTemplate() instanceof SaTempTemplateForJwt;

try { temp.deleteToken(t); } catch (ApiDisabledException e) { /* expected under jwt impl: no-op */ }

When it happens

Trigger: Code written against the Redis/storage-backed SaTempTemplate calls deleteToken(token) while the jwt-temp plugin implementation is active.

Common situations: Swapping the temp-token implementation from storage-based to JWT without auditing call sites; generic cleanup/logout code paths that try to invalidate temp tokens.

Related errors

• CODE_30304
• CODE_30303
• 请配置 jwt 秘钥
• jwt 字符串不可为空
• 30201

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/a8b17db0d4578a61. Report an issue: GitHub.