shuzheng/zheng · error · RuntimeException

无效访问！

Error message

无效访问！

What it means

SSOController.index throws RuntimeException("无效访问！") when the /sso/index request is missing the required appid parameter. The SSO entry point can only identify the calling client system via appid, so a blank value is rejected as an invalid access.

Source

Thrown at zheng-upms/zheng-upms-server/src/main/java/com/zheng/upms/server/controller/SSOController.java:71

    // code key
    private final static String ZHENG_UPMS_SERVER_CODE = "zheng-upms-server-code";

    @Autowired
    UpmsSystemService upmsSystemService;

    @Autowired
    UpmsUserService upmsUserService;

    @Autowired
    UpmsSessionDao upmsSessionDao;

    @ApiOperation(value = "认证中心首页")
    @RequestMapping(value = "/index", method = RequestMethod.GET)
    public String index(HttpServletRequest request) throws Exception {
        String appid = request.getParameter("appid");
        String backurl = request.getParameter("backurl");
        if (StringUtils.isBlank(appid)) {
            throw new RuntimeException("无效访问！");
        }
        // 判断请求认证系统是否注册
        UpmsSystemExample upmsSystemExample = new UpmsSystemExample();
        upmsSystemExample.createCriteria()
                .andNameEqualTo(appid);
        int count = upmsSystemService.countByExample(upmsSystemExample);
        if (0 == count) {
            throw new RuntimeException(String.format("未注册的系统:%s", appid));
        }
        return "redirect:/sso/login?backurl=" + URLEncoder.encode(backurl, "utf-8");
    }

    @ApiOperation(value = "登录")
    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public String login(HttpServletRequest request) {
        Subject subject = SecurityUtils.getSubject();
        Session session = subject.getSession();
        String serverSessionId = session.getId().toString();

View on GitHub (pinned to 7005c0a775)

Solutions

1. Make the client app redirect include both appid and backurl: /sso/index?appid=xxx&backurl=yyy.
2. Verify the appid matches the 'name' of a registered system in the upms_system table.
3. Check reverse-proxy/rewrite rules are not stripping the query string.
4. Catch the RuntimeException in a global exception handler and redirect to a friendly error page instead of a stack trace.

Example fix

// before
String url = ssoServer + "/sso/index?backurl=" + backUrl; // appid missing
// after
String url = ssoServer + "/sso/index?appid=" + appid + "&backurl=" + URLEncoder.encode(backUrl, "utf-8");

String appid = request.getParameter("appid");
if (StringUtils.isBlank(appid)) {
    // reject early / show error page before calling /sso/index
    return "redirect:/error?msg=missing-appid";
}

boolean hasValidSsoParams(HttpServletRequest r) {
    return StringUtils.isNotBlank(r.getParameter("appid"));
}

try {
    return ssoService.initiate(request);
} catch (RuntimeException e) {
    if ("无效访问！".equals(e.getMessage())) {
        return "error/invalid-access";
    }
    throw e;
}

When it happens

Trigger: Hitting GET /sso/index without ?appid=..., or with an empty/whitespace appid, e.g. a client app constructing the redirect URL incorrectly or a user bookmarking/opening the SSO page directly.

Common situations: Client application forgot to append appid (and backurl) when redirecting to the auth center; URL was truncated or the query string lost in a proxy rewrite; manual testing of the SSO URL without parameters.

Related errors

• 未注册的系统:%s

AI-assisted analysis of shuzheng/zheng@7005c0a775 (2026-09-04). Data as JSON: /api/errors/a1aa018a146a85cf. Report an issue: GitHub.