What causes "签名密钥 ${jeecg.signatureSecret} 缺少配置！！" in jeecgboot/JeecgBoot?

Set jeecg.signatureSecret to a non-empty secret string in application.yml (or the appropriate profile config).

jeecgboot/JeecgBoot · critical · JeecgBootException

签名密钥 ${jeecg.signatureSecret} 缺少配置！！

Error message

签名密钥 ${jeecg.signatureSecret} 缺少配置 ！！

What it means

This error is thrown by SignUtil.getSignatureSecret() when the jeecg.signatureSecret configuration property is either empty/null or still contains an unresolved Spring placeholder (e.g. ${jeecg.signatureSecret}). The method reads the value from JeecgBaseConfig, checks for the '${' prefix pattern, and throws JeecgBootException if the secret is not properly configured. This is a startup/runtime configuration error.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/config/sign/util/SignUtil.java:186

                } else if (value != null) {
                    merged.put(key, String.valueOf(value));
                }
            }
        }
        return merged;
    }

    /**
     * 读取并校验签名秘钥配置。
     *
     * @return 有效的签名秘钥
     */
    private static String getSignatureSecret() {
        JeecgBaseConfig jeecgBaseConfig = SpringContextUtils.getBean(JeecgBaseConfig.class);
        String signatureSecret = jeecgBaseConfig.getSignatureSecret();
        String curlyBracket = SymbolConstant.DOLLAR + SymbolConstant.LEFT_CURLY_BRACKET;
        if (oConvertUtils.isEmpty(signatureSecret) || signatureSecret.contains(curlyBracket)) {
            throw new JeecgBootException("签名密钥 ${jeecg.signatureSecret} 缺少配置 ！！");
        }
        return signatureSecret;
    }

}

View on GitHub (pinned to 96fb33f5ec)

Solutions

Set jeecg.signatureSecret to a non-empty secret string in application.yml (or the appropriate profile config).
Verify the property is not overridden to empty in a profile-specific file (application-dev.yml, application-prod.yml).
If using environment variable substitution, ensure the env var is actually set: jeecg.signatureSecret: ${SIGNATURE_SECRET} with the env var present.
Avoid leaving the default placeholder syntax unresolved — use a concrete value or ensure the referenced env var/property exists.

Example fix

# before (application.yml)
jeecg:
  signatureSecret: ${jeecg.signatureSecret}  # unresolved placeholder

# after
jeecg:
  signatureSecret: your-secure-secret-key-here

Defensive patterns

Strategy: validation

Validate before calling

// Startup health check: verify signature secret is configured
@PostConstruct
public void validateSignatureSecret() {
    JeecgBaseConfig config = SpringContextUtils.getBean(JeecgBaseConfig.class);
    String secret = config.getSignatureSecret();
    if (secret == null || secret.isEmpty() || secret.contains("${")) {
    log.error("FATAL: jeecg.signatureSecret is not properly configured!");
        // Optionally fail fast
    }
}

Type guard

public static boolean isSignatureSecretValid(String secret) {
    return secret != null
        && !secret.trim().isEmpty()
        && !secret.contains("${");
}

Try / catch

try {
    signAuthInterceptor.validateSignature(request);
} catch (JeecgBootException e) {
    if (e.getMessage().contains("缺少配置")) {
        log.error("Configuration error: signatureSecret not set. Blocking all signed requests.");
        // Return 503 Service Unavailable, do not retry
        response.setStatus(503);
    }
    throw e;
}

Prevention

Set jeecg.signatureSecret in application.yml with a concrete non-empty value
Never leave property placeholders unresolved — always provide defaults
Add a startup validator that checks critical security configs
Use profile-specific configs to ensure each environment has its own secret

When it happens

Trigger: Any request to a sign-protected endpoint triggers getParamsSign(), which calls getSignatureSecret(). If the signatureSecret value is empty, null, or contains the literal string '${...}' (indicating an unresolved property placeholder), this exception is thrown. This happens lazily on the first signed request, not at startup.

Common situations: The jeecg.signatureSecret property is commented out or missing from application.yml. The property uses a placeholder like ${SIGNATURE_SECRET:} with an empty default. A profile-specific config file overrides the property with an empty value. The property was accidentally removed during a config migration.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/1f52502aa2913521. Report an issue: GitHub.

签名密钥 ${jeecg.signatureSecret} 缺少配置 ！！