jeecgboot/JeecgBoot · error · JeecgBootException

appkey为空

Error message

appkey为空

What it means

Thrown by ApiAuthFilter.checkSignValid when the appkey parameter is blank (null, empty, or whitespace). appkey is the first of three required signed-request parameters (appkey, signature, timestamp) and is validated with StringUtils.hasText before any crypto or DB work.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java:196

        }
        long result = 0;
        for (int i = 0; i < 4; i++) {
            result = (result << 8) | (Integer.parseInt(parts[i]) & 0xFF);
        }
        return result;
    }
    //update-end---author:scott ---date:20260416  for：【PR/9083】OpenAPI白名单增强，支持CIDR网段和通配符匹配-----------

    /**
     * 签名验证
     * @param appkey
     * @param signature
     * @param timestamp
     * @return
     */
    protected void checkSignValid(String appkey, String signature, String timestamp) {
        if (!StringUtils.hasText(appkey)) {
            throw new JeecgBootException("appkey为空");
        }
        if (!StringUtils.hasText(signature)) {
            throw new JeecgBootException("signature为空");
        }
        if (!StringUtils.hasText(timestamp)) {
            throw new JeecgBootException("timastamp时间戳为空");
        }
        if (!timestamp.matches("[0-9]*")) {
            throw new JeecgBootException("timastamp时间戳不合法");
        }
        if (System.currentTimeMillis() - Long.parseLong(timestamp) > 5 * 60 * 1000) {
            throw new JeecgBootException("signature签名已过期(超过五分钟)");
        }
    }

    /**
     * 认证信息核验
     * @param appKey

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Send the appkey as the filter expects - check doFilterInternal for the exact header/param name used (typically 'appkey').
2. Confirm the appkey is non-empty and trimmed of whitespace.
3. Verify the client SDK sets all three: appkey, signature, timestamp.

Example fix

// before: request without appkey
// after:  request.addHeader("appkey", "ak_12345");

// Ensure appkey is present before opening the request
if (appkey == null || appkey.trim().isEmpty()) {
    throw new IllegalStateException("appkey required before OpenAPI call");
}

When it happens

Trigger: An OpenAPI call is made without the appkey header/param, or with an empty string; a client SDK misnames the parameter (e.g. 'appKey' vs 'appkey' depending on case sensitivity of the header map).

Common situations: Client integration forgot to set the appkey; parameter name mismatch between client and the filter's expected header; a test harness that omits credentials.

Related errors

• signature为空
• timastamp时间戳为空
• timastamp时间戳不合法
• signature签名已过期(超过五分钟)
• 不存在认证信息

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/dca547fe60ea4e2e. Report an issue: GitHub.