java.lang.IllegalArgumentException: secret key byte array cannot be null or empty

Question

I am using spring-boot with JWT.

Application.properties

jwt.secret=xyz

Controller.java

@PostMapping(path = "/authenticate")
    public ResponseEntity<?> createAuthenticationToken(@RequestBody JwtRequest authenticationRequest) throws Exception {

        authenticate(authenticationRequest.getUsername(), authenticationRequest.getPassword());

        final UserDetails userDetails = userDetailsService.loadUserByUsername(authenticationRequest.getUsername());

        final String token = jwtTokenUtil.generateToken(userDetails);

        return ResponseEntity.ok(new JwtResponse(token));
    }

JwtTokenUtil.java

    @Value("${jwt.secret}")
    private String secret;
    public String generateToken(UserDetails userDetails) {
            Map<String, Object> claims = new HashMap<>();
            return doGenerateToken(claims, userDetails.getUsername());
        }

        private String doGenerateToken(Map<String, Object> claims, String subject) {

            return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(new Date(System.currentTimeMillis()))
                    .setExpiration(new Date(System.currentTimeMillis() + JWT_TOKEN_VALIDITY*1000)).signWith(SignatureAlgorithm.HS512, secret).compact();
        }

in the jwtTokenUtil.generateToken code I am getting the following error

ERROR o.a.c.c.C.[.[.[.[dispatcherServlet] - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.IllegalArgumentException: secret key byte array cannot be null or empty.] with root cause
java.lang.IllegalArgumentException: secret key byte array cannot be null or empty.
    at io.jsonwebtoken.lang.Assert.notEmpty(Assert.java:204)
    at io.jsonwebtoken.impl.DefaultJwtBuilder.signWith(DefaultJwtBuilder.java:88)
    at io.jsonwebtoken.impl.DefaultJwtBuilder.signWith(DefaultJwtBuilder.java:100)
    at net.javaguides.springboot.helloworldapp.config.JwtTokenUtil.doGenerateToken(JwtTokenUtil.java:66)
    at net.javaguides.springboot.helloworldapp.config.JwtTokenUtil.generateToken(JwtTokenUtil.java:60)
    at net.javaguides.springboot.helloworldapp.controller.BasicAuthController.createAuthenticationToken(BasicAuthController.java:75)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:567)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800)

When I have given my credentials I am getting this error. the application is already validated my credentials, but while generating the token I am getting this error.

UPDATE:-

While debugging I have seen the internal code like below

 @Override
    public JwtBuilder signWith(SignatureAlgorithm alg, String base64EncodedSecretKey) {
        Assert.hasText(base64EncodedSecretKey, "base64-encoded secret key cannot be null or empty.");
        Assert.isTrue(alg.isHmac(), "Base64-encoded key bytes may only be specified for HMAC signatures.  If using RSA or Elliptic Curve, use the signWith(SignatureAlgorithm, Key) method instead.");
        byte[] bytes = TextCodec.BASE64.decode(base64EncodedSecretKey);
        return signWith(alg, bytes);
    }

In this bytes I am getting null

@jps error message is clear but I am giving the jwt.secret=xyz in application.properties file — Gen
– Gen, Commented Feb 18, 2020 at 8:13
in your code you just use secret and it's not clear where or how it is defined: signWith(SignatureAlgorithm.HS512, secret). It's a matter of debugging, set a breakpoint and watch your variables. — jps
– jps, Commented Feb 18, 2020 at 8:31
@jps I have not given the variable diclaration there but in debugging I am getting secret value as xyz, I have edited my question — Gen
– Gen, Commented Feb 18, 2020 at 8:33

Sebastian · Accepted Answer · 2020-02-18 08:53:30Z

7

I think your key need to be base64 encoded See Source: https://github.com/jwtk/jjwt/blob/master/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java#L138

Try following:

    private String doGenerateToken(Map<String, Object> claims, String subject) {

String encodedString = Base64.getEncoder().encodeToString(secret.getBytes())
        return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + JWT_TOKEN_VALIDITY*1000)).signWith(SignatureAlgorithm.HS512, encodedString ).compact();
    }

answered Feb 18, 2020 at 8:53

Sebastian

1696 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

TuGordoBello · Accepted Answer · 2021-11-02 17:26:37Z

7

The secret key is too short. I had the same error and just changing from

jwt.secret=omg

to

jwt.secret=HRlELXqpSB

solved the issue.

edited Nov 2, 2021 at 17:26

TuGordoBello

4,53010 gold badges58 silver badges88 bronze badges

answered Sep 24, 2020 at 8:07

MMarch

852 silver badges6 bronze badges

Comments

user11925689 · Accepted Answer · 2020-06-26 23:11:26Z

0

I had the similar issue and my reason was that the code was not able to get secret value, even though it was declared in application properties and i was reading it. After just doing a set of the secret key, it was able to generate token.

answered Jun 26, 2020 at 23:11

user11925689

11 bronze badge

Comments

Mafei · Accepted Answer · 2021-06-04 19:02:06Z

0

your secret key is too short. please use a long one, like more than 10 characters. then it will be fine.

answered Jun 4, 2021 at 19:02

Mafei

3,9683 gold badges23 silver badges43 bronze badges

Comments

Suresh · Accepted Answer · 2024-02-22 06:24:18Z

0

@Autowired val tokenUtils = JwtTokenUtil()

if you using this class in another class, check @Autowired. its worked

answered Feb 22, 2024 at 6:24

Suresh

1

1 Comment

Community Over a year ago

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.

Collectives™ on Stack Overflow

java.lang.IllegalArgumentException: secret key byte array cannot be null or empty

5 Answers 5

Comments

Comments

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related