jeecgboot/JeecgBoot · error · JeecgBoot401Exception

账号已被锁定,请联系管理员!

Error message

账号已被锁定,请联系管理员!

What it means

Thrown by TokenUtils.verifyToken when the looked-up user's status field is not 1. In JeecgBoot sys_user.status: 1 = normal, 2 = disabled/locked by an admin. Returns HTTP 401. It intentionally rejects still-valid JWTs when the account has been administratively frozen.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/TokenUtils.java:120

        if (StringUtils.isBlank(token)) {
            throw new JeecgBoot401Exception("token不能为空!");
        }

        // 解密获得username，用于和数据库进行对比
        String username = JwtUtil.getUsername(token);
        if (username == null) {
            throw new JeecgBoot401Exception("token非法无效!");
        }

        // 查询用户信息
        LoginUser user = TokenUtils.getLoginUser(username, commonApi, redisUtil);
        //LoginUser user = commonApi.getUserByName(username);
        if (user == null) {
            throw new JeecgBoot401Exception("用户不存在!");
        }
        // 判断用户状态
        if (user.getStatus() != 1) {
            throw new JeecgBoot401Exception("账号已被锁定,请联系管理员!");
        }
        // 校验token是否超时失效 & 或者账号密码是否错误
        if (!jwtTokenRefresh(token, username, user.getPassword(), redisUtil)) {
            // 用户登录Token过期提示信息
            String userLoginTokenErrorMsg = oConvertUtils.getString(redisUtil.get(CommonConstant.PREFIX_USER_TOKEN_ERROR_MSG + token));
            throw new JeecgBoot401Exception(oConvertUtils.isEmpty(userLoginTokenErrorMsg)? CommonConstant.TOKEN_IS_INVALID_MSG: userLoginTokenErrorMsg);
        }
        return true;
    }

    /**
     * 刷新token（保证用户在线操作不掉线）
     * @param token
     * @param userName
     * @param passWord
     * @param redisUtil
     * @return
     */

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. An administrator must re-enable the account (set sys_user.status back to 1) in the user management UI.
  2. If a failed-login lockout policy caused it, wait the configured lock window or have an admin unlock.
  3. Clear the client token so it stops hammering the API with a now-invalid credential.
  4. Audit why the account was locked to rule out a compromise.

Example fix

-- before: account locked
UPDATE sys_user SET status = 2 WHERE username = 'jdoe';

-- after: admin re-enables
UPDATE sys_user SET status = 1 WHERE username = 'jdoe';
Defensive patterns

Strategy: try-catch

Validate before calling

// admin-only check before relying on a token
LoginUser u = TokenUtils.getLoginUser(username, commonApi, redisUtil);
if (u == null || u.getStatus() != 1) { /* locked: stop and prompt contact-admin */ }

Type guard

public static boolean accountActive(LoginUser u){ return u != null && Integer.valueOf(1).equals(u.getStatus()); }

Try / catch

try { TokenUtils.verifyToken(token, ...); }
catch (JeecgBoot401Exception e) { if (e.getMessage().contains("锁定")) showLockedNotice(); }

Prevention

When it happens

Trigger: An admin set the user's status to 2 (frozen) in the user-management screen; the user exceeded failed-login attempts and was auto-locked; or a compliance action disabled the account while the user held an active token.

Common situations: Security lockout after repeated wrong passwords; offboarding disabled the account but the user's tab is still open; manual DB update of status without notifying the user.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/9ec456c47992d59a. Report an issue: GitHub.