{"record":{"id":"49531c50f6faaf30","repo":"spring-projects/spring-security","slug":"keylength-must-be-greater-than-0","errorCode":null,"errorMessage":"keyLength must be greater than 0","messagePattern":"keyLength must be greater than 0","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/keygen/Base64StringKeyGenerator.java","lineNumber":72,"sourceCode":"\t/**\n\t * Creates an instance with keyLength of 32 bytes and the provided encoder.\n\t * @param encoder the encoder to use\n\t */\n\tpublic Base64StringKeyGenerator(Base64.Encoder encoder) {\n\t\tthis(encoder, DEFAULT_KEY_LENGTH);\n\t}\n\n\t/**\n\t * Creates an instance with the provided key length and encoder.\n\t * @param encoder the encoder to use\n\t * @param keyLength the key length to use\n\t */\n\tpublic Base64StringKeyGenerator(Base64.Encoder encoder, int keyLength) {\n\t\tif (encoder == null) {\n\t\t\tthrow new IllegalArgumentException(\"encode cannot be null\");\n\t\t}\n\t\tif (keyLength <= 0) {\n\t\t\tthrow new IllegalArgumentException(\"keyLength must be greater than 0\");\n\t\t}\n\t\tthis.encoder = encoder;\n\t\tthis.keyGenerator = KeyGenerators.secureRandom(keyLength);\n\t}\n\n\t@Override\n\tpublic String generateKey() {\n\t\tbyte[] key = this.keyGenerator.generateKey();\n\t\tbyte[] base64EncodedKey = this.encoder.encode(key);\n\t\treturn new String(base64EncodedKey);\n\t}\n\n}\n","sourceCodeStart":54,"sourceCodeEnd":86,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/keygen/Base64StringKeyGenerator.java#L54-L86","documentation":"The Base64StringKeyGenerator(Base64.Encoder, int) constructor requires a strictly positive keyLength (in bytes for the underlying secure-random generator) and throws IllegalArgumentException('keyLength must be greater than 0') when keyLength <= 0. Zero or negative key lengths cannot produce a usable random key.","triggerScenarios":"Calling new Base64StringKeyGenerator(encoder, 0) or a negative length; passing a length computed from config/math that evaluated to 0 (e.g. bits/bytes conversion error or an empty property defaulting to 0).","commonSituations":"Config property 'keyLength' missing and binding to 0; passing a bit count (e.g. 256) after already dividing by 8 twice; copy-paste from a generator that takes bit length instead of byte length.","solutions":["Pass a positive byte length (e.g. 32 for a 256-bit key).","If the value comes from configuration, validate keyLength > 0 before constructing the generator.","Remember this constructor takes bytes, not bits — convert bits/8 and guard against truncation to 0."],"exampleFix":"// before\nint keyLength = config.getKeyBits() / 8 / 8; // 256 bits -> 0\nBase64StringKeyGenerator gen = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength);\n// after\nint keyLength = config.getKeyBits() / 8; // 256 bits -> 32 bytes\nif (keyLength <= 0) throw new IllegalArgumentException(\"keyBits must be positive\");\nBase64StringKeyGenerator gen = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength);","handlingStrategy":"validation","validationCode":"if (keyLength <= 0) {\n    throw new IllegalArgumentException(\"keyLength must be a positive number of bytes\");\n}\nBase64StringKeyGenerator gen = new Base64StringKeyGenerator(Base64.getEncoder(), keyLength);","typeGuard":"boolean isValidKeyLength(int keyLength) { return keyLength > 0; }","tryCatchPattern":"try {\n    generator = new Base64StringKeyGenerator(encoder, keyLength);\n} catch (IllegalArgumentException ex) {\n    throw new ConfigurationException(\"keyLength must be > 0 (bytes); got \" + keyLength, ex);\n}","preventionTips":["Express key length in bytes and document the unit at the config property level","Sanity-check common sizes: 16 (128-bit), 32 (256-bit); reject values outside a sane range early at startup","Convert bits to bytes once, in one place, with a guard against 0","Fail fast at application startup by validating key-generator configuration in a @PostConstruct or bean factory"],"tags":["keygen","validation","argument-out-of-range","constructor"],"backgroundTag":"argument-out-of-range","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}