{"record":{"id":"1b3bb62b7b329cd4","repo":"iflytek/astron-agent","slug":"40004-illegal-aes-key","errorCode":"-40004","errorMessage":"Illegal AES key","messagePattern":"Illegal AES key","errorType":"error_code","errorClass":"AesException","httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java","lineNumber":57,"sourceCode":"    public WXBizMsgCrypt(String token, String encodingAesKey, String appId) throws AesException {\n        this(token, validateAndDecodeAesKey(encodingAesKey), appId);\n    }\n\n    /**\n     * Private constructor that doesn't throw exceptions\n     */\n    private WXBizMsgCrypt(String token, byte[] aesKey, String appId) {\n        this.token = token;\n        this.aesKey = aesKey;\n        this.appId = appId;\n    }\n\n    /**\n     * Validate and decode AES key\n     */\n    private static byte[] validateAndDecodeAesKey(String encodingAesKey) throws AesException {\n        if (encodingAesKey.length() != 43) {\n            throw new AesException(AesException.IllegalAesKey);\n        }\n        return Base64.decodeBase64(encodingAesKey + \"=\");\n    }\n\n    // Generate 4-byte network byte order\n    byte[] getNetworkBytesOrder(int sourceNumber) {\n        byte[] orderBytes = new byte[4];\n        orderBytes[3] = (byte) (sourceNumber & 0xFF);\n        orderBytes[2] = (byte) (sourceNumber >> 8 & 0xFF);\n        orderBytes[1] = (byte) (sourceNumber >> 16 & 0xFF);\n        orderBytes[0] = (byte) (sourceNumber >> 24 & 0xFF);\n        return orderBytes;\n    }\n\n    // Restore 4-byte network byte order\n    int recoverNetworkBytesOrder(byte[] orderBytes) {\n        int sourceNumber = 0;\n        for (int i = 0; i < 4; i++) {","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java#L39-L75","documentation":"WXBizMsgCrypt validates the WeChat callback encodingAesKey before use: it must be exactly 43 Base64 characters (decoding, with one '=' pad, to a 32-byte AES-256 key). If the length differs it throws AesException with code -40004 (IllegalAesKey).","triggerScenarios":"Constructing WXBizMsgCrypt with a token/AES key taken from the wrong WeChat app, a key with leading/trailing whitespace or newline, a truncated or hand-retyped key, or passing the AppSecret instead of the EncodingAESKey.","commonSituations":"Copy-paste from the WeChat MP console dropping/gaining characters, storing the key in config with quotes or trailing spaces, rotating apps and forgetting to update the key, or using the 32-char AppSecret by mistake.","solutions":["Copy the EncodingAESKey (exactly 43 chars) from the WeChat official account/console config and re-deploy","Trim the value at load time: key = rawKey.trim(), and ensure config storage isn't adding whitespace or quotes","Verify length == 43 before constructing WXBizMsgCrypt","Confirm you are not confusing AppSecret (32 hex chars) with EncodingAESKey"],"exampleFix":"// before\nWXBizMsgCrypt crypt = new WXBizMsgCrypt(token, appSecret, appId); // -40004\n// after\nString aesKey = config.getEncodingAesKey().trim();\nif (aesKey.length() != 43) {\n    throw new IllegalStateException(\"EncodingAESKey must be exactly 43 chars, got \" + aesKey.length());\n}\nWXBizMsgCrypt crypt = new WXBizMsgCrypt(token, aesKey, appId);","handlingStrategy":"validation","validationCode":"if (aesKey == null || aesKey.trim().length() != 43) { throw new IllegalStateException(\"encodingAesKey must be exactly 43 chars\"); }","typeGuard":null,"tryCatchPattern":"try { new WXBizMsgCrypt(token, aesKey, appId); } catch (AesException e) { if (e.getCode() == -40004) { throw new ConfigurationException(\"invalid EncodingAESKey: must be 43 base64 chars\"); } throw e; }","preventionTips":["Trim keys loaded from config/env to remove stray whitespace","Distinguish AppSecret from EncodingAESKey in config naming","Re-verify keys after rotating WeChat apps"],"tags":["java","wechat","aes","config"],"backgroundTag":"invalid-config-value","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}