jeecgboot/JeecgBoot · error · JeecgBootException

appkey错误

Error message

appkey错误

What it means

Thrown by checkSignature when the supplied appKey does not equal openApiAuth.getAk(). This is a defensive equality check: the lookup already found a row by appkey, but the code re-asserts equality, catching mismatches caused by case differences, trailing whitespace, or lookup logic that matched on a partial/normalized key.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java:227

        }
    }

    /**
     * 认证信息核验
     * @param appKey
     * @param signature
     * @param timestamp
     * @param openApiAuth
     * @return
     * @throws Exception
     */
    protected void checkSignature(String appKey, String signature, String timestamp, OpenApiAuth openApiAuth) {
        if(openApiAuth==null){
            throw new JeecgBootException("不存在认证信息");
        }

        if(!appKey.equals(openApiAuth.getAk())){
            throw new JeecgBootException("appkey错误");
        }

        if (!signature.equals(md5(appKey + openApiAuth.getSk() + timestamp))) {
            throw new JeecgBootException("signature签名错误");
        }
    }

    protected void checkPermission(OpenApi openApi, OpenApiAuth openApiAuth) {
        List<OpenApiPermission> permissionList = openApiPermissionService.findByAuthId(openApiAuth.getId());

        boolean hasPermission = false;
        for (OpenApiPermission permission : permissionList) {
            if (permission.getApiId().equals(openApi.getId())) {
                hasPermission = true;
                break;
            }
        }

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Send the appkey with exact case and no whitespace as stored in open_api_auth.ak.
2. Trim both sides consistently; consider storing ak in a canonical (lower/upper) form.
3. Re-check the stored ak value in the admin UI against what the client sends.

Example fix

// before: appKey = " AK_12345 "  (whitespace) or "ak_12345" (case)
// after:  appKey = openApiAuth.getAk() exactly, e.g. "AK_12345"

// Canonicalize appkey before sending/storing to avoid case/whitespace drift
String canonical = appkey == null ? null : appkey.trim();
// store ak in a fixed case (e.g. uppercase) on both sides
String stored = openApiAuth.getAk().trim();
if (!canonical.equals(stored)) { /* reject before request */ }

When it happens

Trigger: Caller sends appkey with different case or surrounding whitespace than stored; the auth service's lookup matched on a normalized form; concurrent update changed the stored ak between lookup and check.

Common situations: Client trims/uppercases the appkey before sending; copy-paste introduced whitespace; database collation matched case-insensitively but the .equals() is case-sensitive.

Related errors

• 不存在认证信息
• signature签名错误
• appkey为空
• signature为空
• timastamp时间戳为空

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/0bef2113ebf347b8. Report an issue: GitHub.