dromara/Sa-Token · error · SaJwtException
jwt 字符串不可为空
Error message
jwt 字符串不可为空
What it means
Thrown by SaJwtTemplate.parseToken when the token argument is null (before any parsing is attempted). It is a simple null-guard so that downstream hutool JWT.of(...) never receives null. No specific error code is set.
Source
Thrown at sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java:178
/**
* jwt 解析
*
* @param token Jwt-Token值
* @param loginType 登录类型
* @param keyt 秘钥
* @param isCheckTimeout 是否校验 timeout 字段
* @return 解析后的jwt 对象
*/
public JWT parseToken(String token, String loginType, String keyt, boolean isCheckTimeout) {
// 秘钥不可以为空
if(SaFoxUtil.isEmpty(keyt)) {
throw new SaJwtException("请配置 jwt 秘钥");
}
// 如果token为null
if(token == null) {
throw new SaJwtException("jwt 字符串不可为空");
}
// 解析
JWT jwt;
try {
jwt = JWT.of(token);
} catch (JWTException | JSONException e) {
throw new SaJwtException("jwt 解析失败：" + token, e).setCode(SaJwtErrorCode.CODE_30201);
}
JSONObject payloads = jwt.getPayloads();
// 校验 Token 签名
boolean verify = jwt.setSigner(createSigner(keyt)).verify();
if( ! verify) {
throw new SaJwtException("jwt 签名无效：" + token).setCode(SaJwtErrorCode.CODE_30202);
}
// 校验 loginType View on GitHub (pinned to ac2c7f6e94)
Solutions
- Ensure the client sends the token (header/cookie/param per your token-style config)
- Reject missing tokens earlier in a filter/interceptor before JWT parsing
- Null-check the token value in your wrapper code before calling parseToken
Example fix
// before
String token = request.getHeader("Authorization"); // null when absent
jwtTemplate.parseToken(token, "login", secret, true); // throws
// after
String token = request.getHeader("Authorization");
if (SaFoxUtil.isEmpty(token)) {
throw new SaTokenException("missing token"); // handle at the boundary
}
jwtTemplate.parseToken(token, "login", secret, true); Defensive patterns
Strategy: validation
Validate before calling
String token = request.getHeader("Authorization");
if (SaFoxUtil.isEmpty(token)) {
response.sendError(401);
return;
} Prevention
- Reject token-less requests in a filter before any StpLogic/JWT call
- Keep token extraction in one helper that returns Optional<String> and short-circuits
When it happens
Trigger: Calling parseToken/getPayloads with a null token string — typically because the request carried no token and the framework passed the raw (null) value through.
Common situations: API endpoint hit without an Authorization/satoken header; token cookie missing so the read returns null; client code variable for the token never initialized; custom filters that forward null instead of rejecting earlier.
Related errors
AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14).
Data as JSON: /api/errors/8de3bcf2019a78ea.
Report an issue: GitHub.