{"record":{"id":"1f52502aa2913521","repo":"jeecgboot/JeecgBoot","slug":"jeecg-signaturesecret","errorCode":null,"errorMessage":"签名密钥 ${jeecg.signatureSecret} 缺少配置 ！！","messagePattern":"签名密钥 (.+?) 缺少配置 ！！","errorType":"exception","errorClass":"JeecgBootException","httpStatus":null,"severity":"critical","filePath":"jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/config/sign/util/SignUtil.java","lineNumber":186,"sourceCode":"                } else if (value != null) {\n                    merged.put(key, String.valueOf(value));\n                }\n            }\n        }\n        return merged;\n    }\n\n    /**\n     * 读取并校验签名秘钥配置。\n     *\n     * @return 有效的签名秘钥\n     */\n    private static String getSignatureSecret() {\n        JeecgBaseConfig jeecgBaseConfig = SpringContextUtils.getBean(JeecgBaseConfig.class);\n        String signatureSecret = jeecgBaseConfig.getSignatureSecret();\n        String curlyBracket = SymbolConstant.DOLLAR + SymbolConstant.LEFT_CURLY_BRACKET;\n        if (oConvertUtils.isEmpty(signatureSecret) || signatureSecret.contains(curlyBracket)) {\n            throw new JeecgBootException(\"签名密钥 ${jeecg.signatureSecret} 缺少配置 ！！\");\n        }\n        return signatureSecret;\n    }\n\n}\n","sourceCodeStart":168,"sourceCodeEnd":192,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/config/sign/util/SignUtil.java#L168-L192","documentation":"This error is thrown by SignUtil.getSignatureSecret() when the jeecg.signatureSecret configuration property is either empty/null or still contains an unresolved Spring placeholder (e.g. ${jeecg.signatureSecret}). The method reads the value from JeecgBaseConfig, checks for the '${' prefix pattern, and throws JeecgBootException if the secret is not properly configured. This is a startup/runtime configuration error.","triggerScenarios":"Any request to a sign-protected endpoint triggers getParamsSign(), which calls getSignatureSecret(). If the signatureSecret value is empty, null, or contains the literal string '${...}' (indicating an unresolved property placeholder), this exception is thrown. This happens lazily on the first signed request, not at startup.","commonSituations":"The jeecg.signatureSecret property is commented out or missing from application.yml. The property uses a placeholder like ${SIGNATURE_SECRET:} with an empty default. A profile-specific config file overrides the property with an empty value. The property was accidentally removed during a config migration.","solutions":["Set jeecg.signatureSecret to a non-empty secret string in application.yml (or the appropriate profile config).","Verify the property is not overridden to empty in a profile-specific file (application-dev.yml, application-prod.yml).","If using environment variable substitution, ensure the env var is actually set: jeecg.signatureSecret: ${SIGNATURE_SECRET} with the env var present.","Avoid leaving the default placeholder syntax unresolved — use a concrete value or ensure the referenced env var/property exists."],"exampleFix":"# before (application.yml)\njeecg:\n  signatureSecret: ${jeecg.signatureSecret}  # unresolved placeholder\n\n# after\njeecg:\n  signatureSecret: your-secure-secret-key-here","handlingStrategy":"validation","validationCode":"// Startup health check: verify signature secret is configured\n@PostConstruct\npublic void validateSignatureSecret() {\n    JeecgBaseConfig config = SpringContextUtils.getBean(JeecgBaseConfig.class);\n    String secret = config.getSignatureSecret();\n    if (secret == null || secret.isEmpty() || secret.contains(\"${\")) {\n    log.error(\"FATAL: jeecg.signatureSecret is not properly configured!\");\n        // Optionally fail fast\n    }\n}","typeGuard":"public static boolean isSignatureSecretValid(String secret) {\n    return secret != null\n        && !secret.trim().isEmpty()\n        && !secret.contains(\"${\");\n}","tryCatchPattern":"try {\n    signAuthInterceptor.validateSignature(request);\n} catch (JeecgBootException e) {\n    if (e.getMessage().contains(\"缺少配置\")) {\n        log.error(\"Configuration error: signatureSecret not set. Blocking all signed requests.\");\n        // Return 503 Service Unavailable, do not retry\n        response.setStatus(503);\n    }\n    throw e;\n}","preventionTips":["Set jeecg.signatureSecret in application.yml with a concrete non-empty value","Never leave property placeholders unresolved — always provide defaults","Add a startup validator that checks critical security configs","Use profile-specific configs to ensure each environment has its own secret"],"tags":["signature","security","configuration","properties"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}