{"record":{"id":"7570ea1addb07223","repo":"alibaba/nacos","slug":"signwithhmacsha1encrypt-fail","errorCode":null,"errorMessage":"signWithhmacSHA1Encrypt fail","messagePattern":"signWithhmacSHA1Encrypt fail","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/SpasAdapter.java","lineNumber":130,"sourceCode":"     * @param encryptText encrypt text\n     * @param encryptKey  encrypt key\n     * @return base64 string\n     */\n    public static String signWithHmacSha1Encrypt(String encryptText, String encryptKey) {\n        try {\n            byte[] data = encryptKey.getBytes(Constants.ENCODE);\n            // Construct a key according to the given byte array, and the second parameter specifies the name of a key algorithm\n            SecretKey secretKey = new SecretKeySpec(data, SHA_ENCRYPT);\n            // Generate a Mac object specifying Mac algorithm\n            Mac mac = Mac.getInstance(SHA_ENCRYPT);\n            // Initialize the Mac object with the given key\n            mac.init(secretKey);\n            byte[] text = encryptText.getBytes(Constants.ENCODE);\n            byte[] textFinal = mac.doFinal(text);\n            // Complete Mac operation, base64 encoding, convert byte array to string\n            return new String(Base64.encodeBase64(textFinal), Constants.ENCODE);\n        } catch (Exception e) {\n            throw new RuntimeException(\"signWithhmacSHA1Encrypt fail\", e);\n        }\n    }\n}\n","sourceCodeStart":112,"sourceCodeEnd":134,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/client-basic/src/main/java/com/alibaba/nacos/client/auth/ram/utils/SpasAdapter.java#L112-L134","documentation":"Thrown by SpasAdapter.signWithHmacSha1Encrypt() as an unchecked RuntimeException wrapping any Exception that occurs during HMAC-SHA1 signing. The try block covers getBytes() (UnsupportedEncodingException), Mac.getInstance() (NoSuchAlgorithmException), mac.init() (InvalidKeyException), and Base64 encoding. This is used to generate the Spas-Signature header for Nacos config/dataId-level access control.","triggerScenarios":"encryptKey (the secret key) is null or invalid for HmacSHA1; encryptText or encryptKey contains characters that cannot be encoded in Constants.ENCODE (UTF-8); the JVM lacks the HmacSHA1 algorithm.","commonSituations":"CredentialService returns a null secretKey; the JVM is a stripped-down distribution without HmacSHA1; encoding issues in non-UTF-8 environments; credential not set before calling getSignHeaders().","solutions":["Ensure the secret key is set and non-null before calling SpasAdapter.getSignHeaders() or any signing operation.","Verify the JVM supports HmacSHA1 (standard on all JDKs; check FIPS/custom JCE configs).","Check the original exception cause in the RuntimeException for the specific failure.","If using CredentialService, ensure it is initialized with valid credentials before signing."],"exampleFix":"// before — calling getSignHeaders with null secretKey\nMap<String, String> headers = SpasAdapter.getSignHeaders(resource, null);\n\n// after\nString sk = CredentialService.getInstance().getCredential().getSecretKey();\nif (sk == null || sk.isEmpty()) {\n    throw new IllegalStateException(\"Secret key not configured\");\n}\nMap<String, String> headers = SpasAdapter.getSignHeaders(resource, sk);","handlingStrategy":"validation","validationCode":"String secretKey = SpasAdapter.getSk();\nif (secretKey == null || secretKey.isEmpty()) {\n    throw new IllegalStateException(\"Cannot sign: secret key is null or empty.\");\n}\n// safe to call getSignHeaders now","typeGuard":null,"tryCatchPattern":"try {\n    headers = SpasAdapter.getSignHeaders(resource, secretKey);\n} catch (RuntimeException e) {\n    if (e.getMessage().contains(\"signWithhmacSHA1Encrypt fail\")) {\n        // Inspect cause for NoSuchAlgorithmException or InvalidKeyException\n        throw new IllegalStateException(\"HMAC-SHA1 signing failed\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Ensure CredentialService is initialized with valid credentials before any signing call.","Verify the JVM supports HmacSHA1 (standard on all JDKs).","Inspect the wrapped cause exception to diagnose the specific signing failure."],"tags":["auth","ram","crypto","signing","spas"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}