iflytek/astron-agent · error · IllegalArgumentException

invalid workflow gateway identity

Error message

invalid workflow gateway identity

What it means

WorkflowGatewayIdentity.sign validates all identity inputs before computing the HMAC-SHA-256: method must be POST, path whitelisted, appId non-blank with no CR/LF, epochSeconds non-negative. Any violation throws IllegalArgumentException to prevent malformed or injection-prone signature payloads.

Solutions

1. Sanitize/validate the appId source — trim and reject values containing CR/LF before calling sign
2. Use System.currentTimeMillis()/1000 (or equivalent) so epochSeconds is non-negative
3. Only call sign after requireAuthorizedPath returns the whitelisted path, and always with POST
4. Catch IllegalArgumentException at the gateway boundary and return 400

Example fix

// before
String appId = header;
String sig = WorkflowGatewayIdentity.sign("POST", path, appId, -1);
// after
String appId = StringUtils.trimToEmpty(header);
if (StringUtils.isBlank(appId) || appId.indexOf('\n') >= 0 || appId.indexOf('\r') >= 0) {
    throw new BusinessException(ResponseEnum.PARAM_ERROR);
}
long epochSeconds = System.currentTimeMillis() / 1000;
String sig = WorkflowGatewayIdentity.sign("POST", path, appId, epochSeconds);

if (StringUtils.isBlank(appId) || appId.indexOf('\n') >= 0 || appId.indexOf('\r') >= 0 || epochSeconds < 0) throw new BusinessException(ResponseEnum.PARAM_ERROR);

boolean signable(String appId, long epochSeconds) { return StringUtils.isNotBlank(appId) && appId.indexOf('\r') < 0 && appId.indexOf('\n') < 0 && epochSeconds >= 0; }

try { sig = WorkflowGatewayIdentity.sign("POST", path, appId, epochSeconds); } catch (IllegalArgumentException e) { return badRequest("invalid gateway identity"); }

When it happens

Trigger: Calling sign with a non-POST method; blank or null appId; appId containing \r or \n (header-injection vector); negative epochSeconds from a broken clock or bad argument; non-whitelisted path passed directly to sign.

Common situations: Clock skew or misconfigured time source yielding negative timestamps; app IDs read from untrusted input with embedded newlines; refactors calling sign with arbitrary methods/paths; integration code bypassing requireAuthorizedPath.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid RID value provided.
• User UID cannot be null
• User ID cannot be null
• unsupported workflow gateway request
• Unable to sign workflow gateway identity

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/886a0a3ac9dc1e6f. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/commons/src/main/java/com/iflytek/astron/console/commons/security/WorkflowGatewayIdentity.java:55

        }
        return path;
    }

    /** Sign {@code method + newline + path + newline + appId + newline + epochSeconds}. */
    public static String sign(
            String configuredKey,
            String method,
            String path,
            String appId,
            long epochSeconds) {
        String internalKey = WorkflowInternalApiKey.requireConfigured(configuredKey);
        if (!POST.equals(method)
                || !PUBLIC_WORKFLOW_PATHS.contains(path)
                || StringUtils.isBlank(appId)
                || appId.indexOf('\r') >= 0
                || appId.indexOf('\n') >= 0
                || epochSeconds < 0) {
            throw new IllegalArgumentException("invalid workflow gateway identity");
        }
        String payload = method + '\n' + path + '\n' + appId + '\n' + epochSeconds;
        try {
            Mac mac = Mac.getInstance(HMAC_SHA_256);
            mac.init(new SecretKeySpec(
                    internalKey.getBytes(StandardCharsets.UTF_8), HMAC_SHA_256));
            return HexFormat.of()
                    .formatHex(
                            mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));
        } catch (GeneralSecurityException exception) {
            throw new IllegalStateException(
                    "Unable to sign workflow gateway identity", exception);
        }
    }
}

View on GitHub (pinned to 5e758547a8)