{"record":{"id":"2533ad5dcbbd9a92","repo":"spring-projects/spring-security","slug":"secretkeyfactoryalgorithm-cannot-be-null","errorCode":null,"errorMessage":"secretKeyFactoryAlgorithm cannot be null","messagePattern":"secretKeyFactoryAlgorithm cannot be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java","lineNumber":170,"sourceCode":"\t * @since 5.8\n\t */\n\tpublic static Pbkdf2PasswordEncoder defaultsForSpringSecurity_v5_8() {\n\t\treturn new Pbkdf2PasswordEncoder(\"\", DEFAULT_SALT_LENGTH, DEFAULT_ITERATIONS, DEFAULT_ALGORITHM);\n\t}\n\n\t/**\n\t * Sets the algorithm to use. See <a href=\n\t * \"https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory\">SecretKeyFactory\n\t * Algorithms</a>\n\t * @param secretKeyFactoryAlgorithm the algorithm to use (i.e.\n\t * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1},\n\t * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256},\n\t * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512})\n\t * @since 5.0\n\t */\n\tpublic void setAlgorithm(SecretKeyFactoryAlgorithm secretKeyFactoryAlgorithm) {\n\t\tif (secretKeyFactoryAlgorithm == null) {\n\t\t\tthrow new IllegalArgumentException(\"secretKeyFactoryAlgorithm cannot be null\");\n\t\t}\n\t\tString algorithmName = secretKeyFactoryAlgorithm.name();\n\t\ttry {\n\t\t\tSecretKeyFactory.getInstance(algorithmName);\n\t\t\tthis.algorithm = algorithmName;\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid algorithm '\" + algorithmName + \"'.\", ex);\n\t\t}\n\t\tif (this.overrideHashWidth) {\n\t\t\tthis.hashWidth = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.equals(secretKeyFactoryAlgorithm) ? 160\n\t\t\t\t\t: SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256.equals(secretKeyFactoryAlgorithm) ? 256 : 512;\n\t\t}\n\t}\n\n\t/**\n\t * Sets if the resulting hash should be encoded as Base64. The default is false which\n\t * means it will be encoded in Hex.","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java#L152-L188","documentation":"Pbkdf2PasswordEncoder.setAlgorithm throws this IllegalArgumentException when handed a null SecretKeyFactoryAlgorithm. The encoder must know which PBKDF2 variant (SHA1/SHA256/SHA512) to request from the JCA SecretKeyFactory, so a null algorithm is invalid configuration. The constructor calls this setter, so passing null there triggers it too.","triggerScenarios":"Calling encoder.setAlgorithm(null), or constructing Pbkdf2PasswordEncoder with code that forwards a nullable algorithm variable resolved from configuration.","commonSituations":"Configuration mapping where the algorithm enum is missing and defaults to null; refactors replacing a default algorithm without updating all construction sites.","solutions":["Pass an explicit algorithm: setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256).","Guard before calling: if (algo != null) encoder.setAlgorithm(algo); else use the encoder default.","Give the configuration property a non-null default (e.g. PBKDF2WithHmacSHA256) in your settings loader."],"exampleFix":"// before\nencoder.setAlgorithm(config.getPbkdf2Algorithm()); // may be null\n// after\nSecretKeyFactoryAlgorithm algo = config.getPbkdf2Algorithm();\nencoder.setAlgorithm(algo != null ? algo : SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);","handlingStrategy":"type-guard","validationCode":"if (algo == null) algo = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256;\nencoder.setAlgorithm(algo);","typeGuard":"SecretKeyFactoryAlgorithm safe = java.util.Optional.ofNullable(configured)\n    .orElse(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);","tryCatchPattern":"try {\n    encoder.setAlgorithm(algo);\n} catch (IllegalArgumentException e) {\n    encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1);\n}","preventionTips":["Give the algorithm configuration key a non-null default in your properties binder.","Construct encoders in a single factory method so null algorithms are normalized once."],"tags":["java","spring-security","pbkdf2","null-check"],"backgroundTag":"null-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}