What causes "Cannot sign up a user while signed in" in theonedev/onedev?

Log out first, then open the sign-up page.

theonedev/onedev · warning · IllegalStateException

Cannot sign up a user while signed in

Error message

Cannot sign up a user while signed in

What it means

The SignUpPage constructor also forbids signing up while a user is already authenticated: if getLoginUser() != null it throws IllegalStateException('Cannot sign up a user while signed in'). OneDev does not allow creating a second account from within an existing session.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/security/SignUpPage.java:49

import io.onedev.server.persistence.TransactionService;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.util.Path;
import io.onedev.server.util.PathNode;
import io.onedev.server.util.patternset.PatternSet;
import io.onedev.server.web.editable.BeanContext;
import io.onedev.server.web.editable.BeanEditor;
import io.onedev.server.web.page.HomePage;
import io.onedev.server.web.page.simple.SimplePage;

public class SignUpPage extends SimplePage {
	
	public SignUpPage(PageParameters params) {
		super(params);
		
		if (!getSecuritySetting().isEnableSelfRegister())
			throw new UnauthenticatedException("User sign-up is disabled");
		if (getLoginUser() != null)
			throw new IllegalStateException("Cannot sign up a user while signed in");
	}
	
	private SecuritySetting getSecuritySetting() {
		return OneDev.getInstance(SettingService.class).getSecuritySetting();
	}
	
	@Override
	protected void onInitialize() {
		super.onInitialize();

		SignUpBean bean = new SignUpBean();
		BeanEditor editor = BeanContext.edit("editor", bean, Sets.newHashSet(PROP_TYPE, PROP_NOTIFY_OWN_EVENTS), true);
		
		Form<?> form = new Form<Void>("form") {

			@Override
			protected void onSubmit() {
				super.onSubmit();

View on GitHub (pinned to d44925c47c)

Solutions

Log out first, then open the sign-up page.
Open the sign-up page in a private/incognito window or a different browser profile.
If you need a second account, use an isolated session or have an admin create it.
Clear the OneDev session cookie if logout appears not to take effect.

Defensive patterns

Strategy: validation

Validate before calling

if (SecurityUtils.getLoginUser() != null) {
  // already signed in: skip sign-up, go to 'my account'
}

Try / catch

try {
  openSignUpPage();
} catch (IllegalStateException e) {
  // user is signed in; redirect to profile page
}

Prevention

Check login state before showing sign-up entry points.
Use incognito/isolated sessions to test sign-up flows.
Avoid bookmarks to /~register; navigate from the logged-out page.
Confirm logout completed (no remember-me) before registering a new account.

When it happens

Trigger: Opening the sign-up URL while already logged in — e.g. navigating to /~register manually, following an old bookmark, or a shared sign-up link opened in a browser that already has a OneDev session.

Common situations: Trying to create a second account for yourself in the same browser; testing sign-up as an admin without logging out or using incognito; auto-login (SSO/remember-me) silently keeping you signed in.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/ab123189836e5871. Report an issue: GitHub.