hs-web/hsweb-framework · error · UnsupportedOperationException

不支持的验证规则:

Error message

不支持的验证规则:

What it means

UnsupportedTwoFactorValidator is a placeholder implementation of TwoFactorValidator used when no real two-factor provider is registered for the configured provider name. Both verify() and expired() unconditionally throw UnsupportedOperationException, embedding the provider name in the message. It signals that the requested two-factor validation rule does not exist.

Solutions

1. Check the provider name configured for two-factor authentication and correct it to a registered provider (e.g. 'default').
2. Ensure the module containing the actual TwoFactorValidator implementation (e.g. hsweb-authorization-token or a custom one) is a dependency and its bean is registered.
3. Register a custom TwoFactorValidator bean for the provider name your application uses.
4. Wrap verify()/expired() calls in try-catch for UnsupportedOperationException to fail gracefully with a clear message.

Example fix

// before
two-factor:
  provider: sms   # no provider registered under 'sms'
// after
two-factor:
  provider: default   # matches a registered TwoFactorValidator bean

// check the provider is real before use
if (validator instanceof UnsupportedTwoFactorValidator) {
    throw new IllegalStateException("two-factor provider not configured: " + providerName);
}

boolean isRealValidator(TwoFactorValidator v) {
    return !(v instanceof UnsupportedTwoFactorValidator);
}

try {
    boolean ok = validator.verify(code, timeout);
} catch (UnsupportedOperationException e) {
    log.error("two-factor provider unavailable: {}", e.getMessage());
    throw new AuthenticationException("two-factor validation unavailable", e);
}

When it happens

Trigger: Calling TwoFactorValidatorProvider.verify(code, timeout) or expired() when the two-factor provider resolved by name is this fallback stub — i.e. the configured provider string does not match any registered validator.

Common situations: Misconfigured two-factor provider name in application properties; a two-factor provider module/dependency not on the classpath; calling the API before a custom TwoFactorValidator bean is registered.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• unsupported dialect :
• 不支持的授权请求:
• parentId
• join class [" + clazz + "] not found!
• join alias [" + alias + "] not found!

AI-assisted analysis of hs-web/hsweb-framework@b2cfc85a57 (2026-09-13). Data as JSON: /api/errors/49296f9f03fc5cc3. Report an issue: GitHub.

Appendix: source

Thrown at hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/twofactor/defaults/UnsupportedTwoFactorValidator.java:19

package org.hswebframework.web.authorization.twofactor.defaults;

import lombok.AllArgsConstructor;
import lombok.Getter;
import org.hswebframework.web.authorization.twofactor.TwoFactorValidator;

/**
 * @author zhouhao
 * @since 3.0.4
 */
@AllArgsConstructor
public class UnsupportedTwoFactorValidator implements TwoFactorValidator {

    @Getter
    private String provider;

    @Override
    public boolean verify(String code, long timeout) {
        throw new UnsupportedOperationException("不支持的验证规则:" + provider);
    }

    @Override
    public boolean expired() {
        throw new UnsupportedOperationException("不支持的验证规则:" + provider);
    }
}

View on GitHub (pinned to b2cfc85a57)