theonedev/onedev · warning · org.apache.wicket.authorization.UnauthorizedListenerInvocationException$ListenerInvocationNotAllowedException

Component rejected interface invocation

Error message

Component rejected interface invocation

What it means

Wicket throws ListenerInvocationNotAllowedException when a request targets a listener interface (e.g. an Ajax/Link onClick) on a component that fails canCallListenerInterface() — typically because the component is not visible or not enabled at request time. This is a deliberate silent-fail guard against stale or forged callbacks: the page is simply re-rendered instead of invoking the handler.

Source

Thrown at server-core/src/main/java/org/apache/wicket/RequestListenerInterface.java:217

	 * @param rcomponent
	 *            The component
	 * 
	 * @throws ListenerInvocationNotAllowedException
	 *             when listener invocation attempted on a component that does not allow it
	 */
	public final void invoke(final IRequestableComponent rcomponent)
	{
		// we are in Wicket core land
		final Component component = (Component)rcomponent;

		HierarchicalContext.push(new HierarchicalContext(new ComponentHierarchical(component)));
		try {
			if (!component.canCallListenerInterface(method))
			{
				// just return so that we have a silent fail and just re-render the
				// page
				log.info("component not enabled or visible; ignoring call. Component: " + component);
				throw new ListenerInvocationNotAllowedException(this, component, null,
					"Component rejected interface invocation");
			}
	
			internalInvoke(component, component);
		} finally {
			HierarchicalContext.pop();
		}
	}

	/**
	 * Invokes a given interface on a component's behavior.
	 * 
	 * @param rcomponent
	 *            The component
	 * @param behavior
	 * @throws ListenerInvocationNotAllowedException
	 *             when listener invocation attempted on a component that does not allow it
	 */

View on GitHub (pinned to d44925c47c)

Solutions

1. Check why the component is not visible/enabled on the server for this request — align the visibility logic between render and request phases
2. If hiding intentionally, also disable the component or replace it so clients cannot post stale callbacks
3. Use setVisibilityAllowed vs setVisible correctly and keep model state consistent across requests
4. Log the component path in a custom IRequestCycleListener to identify which component/callback is affected

Example fix

// before
link.setVisible(user.isAdmin()); // hidden later, but browser still has old callback URL
// after
link.setVisible(user.isAdmin());
link.setEnabled(user.isAdmin()); // guard both dimensions, or remove the link entirely

if (component.isVisibleInHierarchy() && component.isEnabledInHierarchy()) {
    // safe: listener invocation will be accepted
}

try {
    target.scheduleComponentRender(component);
} catch (ListenerInvocationNotAllowedException e) {
    log.warn("Stale callback ignored: {}", e.getMessage());
    target.add(page); // re-render silently
}

When it happens

Trigger: Clicking a link/Ajax button whose component has setVisible(false) or setEnabled(false) on the server since the page was rendered; replaying a stale request after state change; bookmarking/re-rendering a page where the component was removed or conditionally hidden.

Common situations: Conditional UI rendering differs between render and request (e.g. visibility depends on user role or model data that changed); back-button navigation to an outdated page; stateless pages where component state was not recreated identically.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• Behavior rejected interface invocation.
• Page classes should extend from BasePage.
• Base resource mapper should be used
• Invalid date range, expecting "yyyy-MM-dd to yyyy-MM-dd"
• Path '${mountPath}' should be mounted to a svg sprite resour

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/838ef72a8f3422dd. Report an issue: GitHub.