jeecgboot/JeecgBoot · error · JeecgBootException

signature为空

Error message

signature为空

What it means

Thrown by checkSignValid when the signature parameter is blank. It is the second guard after appkey, ensuring the MD5 signature the client must compute (md5(appkey + sk + timestamp)) is present before validation against the stored secret.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java:199

            result = (result << 8) | (Integer.parseInt(parts[i]) & 0xFF);
        }
        return result;
    }
    //update-end---author:scott ---date:20260416  for：【PR/9083】OpenAPI白名单增强，支持CIDR网段和通配符匹配-----------

    /**
     * 签名验证
     * @param appkey
     * @param signature
     * @param timestamp
     * @return
     */
    protected void checkSignValid(String appkey, String signature, String timestamp) {
        if (!StringUtils.hasText(appkey)) {
            throw new JeecgBootException("appkey为空");
        }
        if (!StringUtils.hasText(signature)) {
            throw new JeecgBootException("signature为空");
        }
        if (!StringUtils.hasText(timestamp)) {
            throw new JeecgBootException("timastamp时间戳为空");
        }
        if (!timestamp.matches("[0-9]*")) {
            throw new JeecgBootException("timastamp时间戳不合法");
        }
        if (System.currentTimeMillis() - Long.parseLong(timestamp) > 5 * 60 * 1000) {
            throw new JeecgBootException("signature签名已过期(超过五分钟)");
        }
    }

    /**
     * 认证信息核验
     * @param appKey
     * @param signature
     * @param timestamp
     * @param openApiAuth

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Compute signature = md5(appkey + sk + timestamp) and send it in the signature param/header expected by the filter.
2. Verify the parameter name and casing match the filter's extraction.
3. Ensure no intermediary proxy strips the header.

Example fix

// before: request.addHeader("appkey", ak);  // signature omitted
// after:  String sig = md5(ak + sk + ts);
//         request.addHeader("appkey", ak);
//         request.addHeader("signature", sig);
//         request.addHeader("timestamp", ts);

if (signature == null || signature.trim().isEmpty()) {
    throw new IllegalStateException("signature required");
}

When it happens

Trigger: OpenAPI call missing the signature header/param; client computed the signature but did not attach it to the request; case-sensitivity mismatch on the parameter name.

Common situations: Client SDK builds the signature but forgets to send it; a proxy strips unknown headers; integration test that hard-codes only appkey and timestamp.

Related errors

• appkey为空
• timastamp时间戳为空
• timastamp时间戳不合法
• signature签名已过期(超过五分钟)
• 不存在认证信息

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/6927af562b40e7a1. Report an issue: GitHub.