What causes "账号或密码错误，未通过校验" in dromara/Sa-Token?

Send the exact name and pwd values configured on the @CheckAccount annotation as request parameters.

dromara/Sa-Token · warning · SaTokenException

账号或密码错误，未通过校验

Error message

账号或密码错误，未通过校验

What it means

SaTokenException thrown by a custom-annotation handler (CheckAccountHandler) in the solon demo when the request's name/pwd parameters do not equal the values declared on the @CheckAccount annotation. It demonstrates sa-token's custom annotation checking extension point: every request to a method annotated with @CheckAccount re-submits credentials and compares them against the annotation attributes.

Source

Thrown at sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java:38

    // 指定这个处理器要处理哪个注解
    @Override
    public Class<CheckAccount> getHandlerAnnotationClass() {
        return CheckAccount.class;
    }

    // 每次请求校验注解时，会执行的方法
    @Override
    public void checkMethod(CheckAccount at, AnnotatedElement method) {
        // 获取前端请求提交的参数
        String name = SaHolder.getRequest().getParamNotNull("name");
        String pwd = SaHolder.getRequest().getParamNotNull("pwd");

        // 与注解中指定的值相比较
        if(name.equals(at.name()) && pwd.equals(at.pwd()) ) {
            // 校验通过，什么也不做
        } else {
            // 校验不通过，则抛出异常
            throw new SaTokenException("账号或密码错误，未通过校验");
        }
    }

}

View on GitHub (pinned to ac2c7f6e94)

Solutions

Send the exact name and pwd values configured on the @CheckAccount annotation as request parameters.
If parameters are missing entirely, add them — getParamNotNull throws a different 'missing param' error before this comparison runs.
After editing annotation values, restart and update the client to the new credentials.
For real projects, replace equality-check-with-annotation-constants by real credential verification (this is demo code by design).

Example fix

// before
@CheckAccount(name="zhang", pwd="123456")
@Mapping("/info")
public String info() { ... }
// request: GET /info  -> throws

// after
// request: GET /info?name=zhang&pwd=123456  -> passes

Defensive patterns

Strategy: validation

Validate before calling

// before invoking an endpoint annotated with @CheckAccount(name="zhang", pwd="123456")
String name = "zhang", pwd = "123456"; // must match annotation exactly
// append as query/form params to every request

Try / catch

try { ... } catch (SaTokenException e) { if (e.getMessage().contains("账号或密码错误")) { /* fix request params */ } }

Prevention

Keep annotation credential values and the client's sent params in one config source so they cannot drift.
Remember this handler runs on EVERY request to the annotated method — credentials must be supplied each time.

When it happens

Trigger: Invoking any endpoint whose method/class carries @CheckAccount(name="...") while the HTTP request lacks matching name and pwd parameters, or they differ from the annotation values. getParamNotNull also throws earlier if either parameter is absent entirely.

Common situations: Running the solon demo and testing an annotated route without appending ?name=xxx&pwd=xxx; changing the annotation values but keeping old query params; integrating the pattern into real code and forgetting the request must carry the credentials on every call.

Related errors

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/11cd20019896f489. Report an issue: GitHub.