dromara/Sa-Token · warning · SaTokenException

账号或密码错误，未通过校验

Error message

账号或密码错误，未通过校验

What it means

This is demo code in sa-token-demo-case showing how to write a custom annotation handler. CheckAccountHandler.checkMethod implements a custom @CheckAccount annotation: it reads request parameters 'name' and 'pwd' and compares them against the annotation's configured name()/pwd(). Mismatch throws SaTokenException('账号或密码错误，未通过校验'). It is example code, not library logic — hitting it means you are running the demo app.

Source

Thrown at sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java:38

    // 指定这个处理器要处理哪个注解
    @Override
    public Class<CheckAccount> getHandlerAnnotationClass() {
        return CheckAccount.class;
    }

    // 每次请求校验注解时，会执行的方法
    @Override
    public void checkMethod(CheckAccount at, AnnotatedElement element) {
        // 获取前端请求提交的参数
        String name = SaHolder.getRequest().getParamNotNull("name");
        String pwd = SaHolder.getRequest().getParamNotNull("pwd");

        // 与注解中指定的值相比较
        if(name.equals(at.name()) && pwd.equals(at.pwd()) ) {
            // 校验通过，什么也不做
        } else {
            // 校验不通过，则抛出异常
            throw new SaTokenException("账号或密码错误，未通过校验");
        }
    }

}

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Send the exact name and pwd expected by the annotation on the endpoint you are calling
2. Read the endpoint's annotation values (they are hardcoded in the demo controller) and match them
3. If you adapted this handler, replace the equality check with your real account-verification logic

Example fix

// before: endpoint has @CheckAccount(name="zhang", pwd="123456")
GET /custom_annotation/check?name=zhang&pwd=111  // 401-ish exception

// after
GET /custom_annotation/check?name=zhang&pwd=123456

// demo-only: read the annotation values and compare before invoking
CheckAccount at = method.getAnnotation(CheckAccount.class);
String name = SaHolder.getRequest().getParam("name");
String pwd = SaHolder.getRequest().getParam("pwd");
if (!java.util.Objects.equals(name, at.name())
        || !java.util.Objects.equals(pwd, at.pwd())) {
    // return a clean 401 instead of throwing
}

try {
    // request @CheckAccount-protected endpoint
} catch (SaTokenException e) {
    if (e.getMessage().contains("账号或密码错误")) { /* re-prompt for credentials */ }
}

When it happens

Trigger: In the sa-token-demo-case app, requesting an endpoint annotated @CheckAccount(name="xxx", pwd="yyy") while the request lacks or mismatches the name/pwd query parameters. Missing parameters throw earlier in getParamNotNull.

Common situations: Following the custom-annotation tutorial and typing different credentials; copying the handler into your own project and forgetting that the comparison is plain string equality against hardcoded annotation values.

Related errors

• UsernameAndPassword 不能为空
• UsernameAndPassword 格式错误，正确格式为：username:password
• 10312
• 设备id或用户id不能为空
• 此设备id目前未绑定任何用户

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/7ee5a5b9c0439435. Report an issue: GitHub.