binarywang/WxJava · error · IllegalArgumentException

非法请求参数，有部分参数为空 :

Error message

非法请求参数，有部分参数为空 : 

What it means

SHA1.gen concatenates the provided string arguments, sorts them, and computes a SHA-1 digest — the core of WeChat signature verification (JS-SDK, message signing, token validation). If ANY argument is null or empty it throws IllegalArgumentException, because a signature over incomplete material would be silently invalid. This is a strict precondition on signature inputs.

Source

Thrown at weixin-java-common/src/main/java/me/chanjar/weixin/common/util/crypto/SHA1.java:20

import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang3.StringUtils;

import java.util.Arrays;

/**
 *
 * @author Daniel Qian
 * created on  14/10/19
 */
public class SHA1 {

  /**
   * 串接arr参数，生成sha1 digest.
   */
  public static String gen(String... arr) {
    if (StringUtils.isAnyEmpty(arr)) {
      throw new IllegalArgumentException("非法请求参数，有部分参数为空 : " + Arrays.toString(arr));
    }

    Arrays.sort(arr);
    StringBuilder sb = new StringBuilder();
    for (String a : arr) {
      sb.append(a);
    }
    return DigestUtils.sha1Hex(sb.toString());
  }

  /**
   * {@code 用&串接arr参数，生成sha1 digest.}
   *
   * @param arr 参数数组
   * @return sha1摘要
   */
  public static String genWithAmple(String... arr) {
    if (StringUtils.isAnyEmpty(arr)) {

View on GitHub (pinned to 1c43293a3c)

Solutions

1. Ensure all signature inputs (token, timestamp, nonce, ticket, etc.) are fetched and non-empty before calling SHA1.gen.
2. Pre-fetch and cache jsapi_ticket/access_token so they are never null at sign time.
3. Validate each input non-empty with a guard and fail with a clear message before invoking SHA1.gen.
4. On callbacks, reject requests missing any signature component early.

Example fix

// before — ticket still null when signing
String sig = SHA1.gen(nonce, timestamp, url, jsapiTicket); // throws

// after — ensure ticket present
if (StringUtils.isEmpty(jsapiTicket)) {
  jsapiTicket = refreshJsapiTicket();
}
String sig = SHA1.gen(nonce, timestamp, url, jsapiTicket);

if (StringUtils.isAnyEmpty(token, timestamp, nonce, ticket)) {
  throw new IllegalArgumentException("Signature inputs must all be non-empty: token/timestamp/nonce/ticket");
}
String sig = SHA1.gen(token, timestamp, nonce, ticket);

private static boolean signatureInputsReady(String... parts) {
  if (parts == null) return false;
  for (String p : parts) {
    if (p == null || p.isEmpty()) return false;
  }
  return true;
}

try {
  return SHA1.gen(token, timestamp, nonce, ticket);
} catch (IllegalArgumentException e) {
  // one of the signature inputs was null/empty — refresh ticket/token and retry
  ticket = refreshJsapiTicket();
  return SHA1.gen(token, timestamp, nonce, ticket);
}

When it happens

Trigger: Calling SHA1.gen with a null/empty token, timestamp, nonce, encryptStr, or jsapiTicket — i.e. one of the signature inputs was not fetched/available before signing.

Common situations: jsapi_ticket not yet fetched (null) when computing a JS-SDK signature; access_token/token missing; timestamp or nonce generated as empty string; a callback handler receiving a request with a missing signature component.

Related errors

• uri参数中不允许有access_token: {uri}
• 表单字段名不能为空
• setAttribute: name parameter cannot be null
• 更新「联系我」方式需要指定configId
• userid 不能为空

AI-assisted analysis of binarywang/WxJava@1c43293a3c (2026-08-14). Data as JSON: /api/errors/8e4be556ae231fd9. Report an issue: GitHub.