paascloud/paascloud-master · error · UacBizException

UAC10011028

UAC10011028

Error message

链接已失效

What it means

UAC10011028 (message '链接已失效' — link has expired) is thrown by the reset-password-by-key flow when the reset token key (RedisKeyUtil.getResetPwdTokenKey(resetPwdKey)) has no value in Redis, or the value is empty. The reset link's token was never stored, was already consumed (deleted after successful reset), or expired from Redis TTL.

Solutions

1. Have the user request a fresh reset link and use it before expiry
2. Ensure the reset flow is single-use in the UI (disable after first success) to avoid confusing double submits
3. Check Redis connectivity and TTL configuration for the reset-token keys; enable persistence if restarts are losing tokens
4. Catch UacBizException code UAC10011028 and redirect the user to the 'forgot password' page to re-request a token

Example fix

// before
uacUserService.resetLoginPwdByRestPwdKey(oldTokenFromEmail, newPwd, confirmPwd);
// after
String key = RedisKeyUtil.getResetPwdTokenKey(token);
if (Boolean.TRUE.equals(redisTemplate.hasKey(key))) {
    uacUserService.resetLoginPwdByRestPwdKey(token, newPwd, confirmPwd);
} else {
    // prompt user to request a new reset link
}

Boolean exists = redisTemplate.hasKey(RedisKeyUtil.getResetPwdTokenKey(resetPwdKey));
if (!Boolean.TRUE.equals(exists)) { /* token expired/used: prompt new reset request */ }

try { uacUserService.resetLoginPwdByRestPwdKey(key, newPwd, confirmPwd); } catch (UacBizException e) { if ("UAC10011028".equals(e.getCode())) { /* redirect to forgot-password to re-request token */ } }

When it happens

Trigger: Submitting resetLoginPwdByRestPwdKey(resetPwdKey, newPassword, confirmNewPassword) with a resetPwdKey whose Redis entry is missing: token expired, already used once (service deletes the key after success), Redis flushed/restarted without persistence, or a fabricated/wrong key.

Common situations: User clicking an emailed reset link after it expired; double-submitting the reset form (second attempt finds key deleted); Redis restart/eviction losing tokens; clocks/TTL misconfiguration making tokens short-lived; copying an incomplete token from the URL.

Related errors

• 无法找到缓存的用户社交账号信息
• 设备id参数不能为空
• 验证码已过期
• 请在请求头中携带deviceId参数
• Mobile当天短信发送数上限

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/857dacbcf3f8869d. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java:698

	}

	@Override
	public void resetLoginPwd(ResetLoginPwdDto resetLoginPwdDto) {
		String confirmPwd = resetLoginPwdDto.getConfirmPwd();
		String newPassword = resetLoginPwdDto.getNewPassword();
		String resetPwdKey = resetLoginPwdDto.getResetPwdKey();

		Preconditions.checkArgument(!StringUtils.isEmpty(newPassword), ErrorCodeEnum.UAC10011014.msg());
		Preconditions.checkArgument(!StringUtils.isEmpty(confirmPwd), ErrorCodeEnum.UAC10011009.msg());
		Preconditions.checkArgument(!StringUtils.isEmpty(resetPwdKey), "链接已失效");
		Preconditions.checkArgument(newPassword.equals(confirmPwd), "两次输入密码不一致");

		String resetPwdTokenKey = RedisKeyUtil.getResetPwdTokenKey(resetPwdKey);
		UacUser uacUser = (UacUser) redisTemplate.opsForValue().get(resetPwdTokenKey);

		if (StringUtils.isEmpty(uacUser)) {
			throw new UacBizException(ErrorCodeEnum.UAC10011028);
		}

		LoginAuthDto loginAuthDto = new LoginAuthDto();
		loginAuthDto.setUserName(uacUser.getUserName());
		loginAuthDto.setLoginName(uacUser.getLoginName());
		loginAuthDto.setUserId(uacUser.getId());

		UacUser update = new UacUser();
		String salt = generateId() + "";
		update.setLoginPwd(Md5Util.encrypt(newPassword));
		update.setSalt(salt);
		update.setId(uacUser.getId());
		// 该用户已经修改过密码
		update.setIsChangedPwd((Short.valueOf("1")));
		update.setUpdateInfo(loginAuthDto);

		int result = uacUserMapper.updateByPrimaryKeySelective(update);
		if (result < 1) {

View on GitHub (pinned to 781281a950)