dromara/Sa-Token · error · RuntimeException

当前会话未登录

Error message

当前会话未登录

What it means

RuntimeException thrown by the SSO3 client demo's StpLogicForHttpSession.getLoginId() when the HttpSession attribute "userId" is absent. This demo replaces sa-token's default token logic with one backed purely by the Servlet HttpSession, so 'logged in' means session attribute userId != null; getLoginId() has no fallback and fails hard when unset.

Source

Thrown at sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-resdk/src/main/java/com/pj/resdk/StpLogicForHttpSession.java:40

     *
     */
    public StpLogicForHttpSession(String type) {
        super(type);
    }

    // 判断当前会话是否已登录
    @Override
    public boolean isLogin() {

        return SpringMVCUtil.getRequest().getSession().getAttribute("userId") != null;
    }

    // 获取当前会话的登录ID
    @Override
    public Object getLoginId() {
        Object userId = SpringMVCUtil.getRequest().getSession().getAttribute("userId");
        if(userId == null) {
            throw new RuntimeException("当前会话未登录");
        }
        return userId;
    }

    // 获取当前登录设备 id
    @Override
    public String getLoginDeviceId() {
        return null;
    }

    // 当前会话注销
    @Override
    public void logout(SaLogoutParameter logoutParameter) {
        SpringMVCUtil.getRequest().getSession().removeAttribute("userId");
    }

    // 当前账号id注销
    @Override

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Guard with isLogin() before calling getLoginId() — the sibling method returns a boolean for exactly this check.
2. Complete the SSO login flow (ticket validation) so the session attribute userId gets set before protected pages call getLoginId().
3. Ensure the JSESSIONID cookie is sent (same-domain or proper cookie config) so the session persists across requests.
4. Increase session timeout or use persistent sessions if restarts are frequent in dev.

Example fix

// before
Object userId = StpUtil.getLoginId(); // throws when not logged in

// after
if (!StpUtil.isLogin()) {
    response.sendRedirect("/sso/login?back=" + URLUtil.encode(currentUrl));
    return;
}
Object userId = StpUtil.getLoginId();

if (!StpUtil.isLogin()) { // delegates to session attribute check, returns boolean
    // redirect to SSO login instead of calling getLoginId()
}
Object userId = StpUtil.getLoginId();

boolean isLoggedIn() { return SpringMVCUtil.getRequest().getSession().getAttribute("userId") != null; }

try { Object id = StpUtil.getLoginId(); } catch (RuntimeException e) { if ("当前会话未登录".equals(e.getMessage())) { /* redirect to login */ } }

When it happens

Trigger: Calling StpUtil.getLoginId() (delegating to this StpLogic) on a session where login(userId) was never called, the session timed out, the session was invalidated (logout), or the request arrives without the JSESSIONID cookie (new session each time).

Common situations: SSO3-client demo accessed in a browser with cookies blocked; server restart losing in-memory sessions; calling getLoginId in a filter that runs before the SSO ticket exchange sets userId.

Related errors

• 10004
• 账号或密码错误，未通过校验
• 设备id或用户id不能为空
• 此设备id目前未绑定任何用户
• 验证码错误

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/bd3e72bd2163b0fc. Report an issue: GitHub.