{"record":{"id":"accb6955c4f53789","repo":"alibaba/nacos","slug":"the-length-of-secret-key-must-great-than-or-equal","errorCode":null,"errorMessage":"the length of secret key must great than or equal 32 bytes; And the secret key must be encoded by base64. Please see https://nacos.io/docs/latest/manual/admin/auth/","messagePattern":"the length of secret key must great than or equal 32 bytes; And the secret key must be encoded by base64\\. Please see https://nacos\\.io/docs/latest/manual/admin/auth/","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/configuration/NacosAuthPluginConfig.java","lineNumber":148,"sourceCode":"        }\n    }\n    \n    private static boolean parseBoolean(String value, String key) {\n        if (!Boolean.TRUE.toString().equalsIgnoreCase(value)\n            && !Boolean.FALSE.toString().equalsIgnoreCase(value)) {\n            throw new IllegalArgumentException(\"Plugin config value is not a boolean: \" + key);\n        }\n        return Boolean.parseBoolean(value);\n    }\n    \n    private static void validateTokenSecret(String tokenSecretKey) {\n        if (StringUtils.isBlank(tokenSecretKey)) {\n            return;\n        }\n        try {\n            new NacosJwtParser(tokenSecretKey);\n        } catch (RuntimeException e) {\n            throw new IllegalArgumentException(INVALID_SECRET_MESSAGE, e);\n        }\n    }\n    \n    public String getTokenSecretKey() {\n        return tokenSecretKey;\n    }\n    \n    public long getTokenExpireSeconds() {\n        return tokenExpireSeconds;\n    }\n    \n    public boolean isTokenCacheEnabled() {\n        return tokenCacheEnabled;\n    }\n    \n    public boolean isCachingEnabled() {\n        return cachingEnabled;\n    }","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/configuration/NacosAuthPluginConfig.java#L130-L166","documentation":"Thrown by validateTokenSecret() in NacosAuthPluginConfig when token.secret.key is non-blank but fails to construct a NacosJwtParser — meaning the key is not valid base64 or decodes to fewer than 32 bytes. The original RuntimeException is wrapped in an IllegalArgumentException carrying the INVALID_SECRET_MESSAGE constant.","triggerScenarios":"token.secret.key is set to a plain-text string shorter than 32 bytes, or to a value that is not valid base64; new NacosJwtParser(tokenSecretKey) throws and the catch (RuntimeException) rethrows with the descriptive message.","commonSituations":"Using a short human-readable password as the secret key; pasting a key with embedded newlines or spaces that break base64; generating a key with the wrong tool (e.g., a hex string instead of base64).","solutions":["Generate a proper key: openssl rand -base64 64 (guarantees >= 32 decoded bytes and valid base64).","Ensure the key has no leading/trailing whitespace or newlines when placed in the config file.","Verify the key decodes to >= 32 bytes before deploy (echo -n \"$KEY\" | base64 -d | wc -c)."],"exampleFix":"// before\nnacos.core.auth.plugin.nacos.token.secret.key=mysecret\n\n// after (generate: openssl rand -base64 64)\nnacos.core.auth.plugin.nacos.token.secret.key=VGhpcyBpcyBhIHZlcnkgbG9uZyBiYXNlNjQgc2VjcmV0IGtleSB0aGF0IGlzIDMyKyBieXRl cw==","handlingStrategy":"validation","validationCode":"String key = config.get(NacosAuthPluginConfig.TOKEN_SECRET_KEY);\nif (StringUtils.isNotBlank(key)) {\n    byte[] decoded = java.util.Base64.getDecoder().decode(key);\n    if (decoded.length < 32) {\n        throw new IllegalArgumentException(\n            \"token.secret.key decodes to \" + decoded.length + \" bytes; minimum is 32\");\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    NacosAuthPluginConfig.from(config, authEnabled);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"secret key must great than\")) {\n        log.error(\"token.secret.key invalid: must be base64 decoding to >= 32 bytes\");\n    }\n    throw e;\n}","preventionTips":["Generate keys with openssl rand -base64 64 and verify decode length >= 32 bytes.","Trim whitespace/newlines from the key before storing it in config.","Centralize key generation so no hand-typed keys reach production."],"tags":["auth","config","security","token","jwt"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}