jeecgboot/JeecgBoot · error · JeecgBootException

timastamp时间戳不合法

Error message

timastamp时间戳不合法

What it means

Thrown by checkSignValid when the timestamp fails the regex '[0-9]*' (i.e. contains non-digit characters, or is empty after the hasText check). The matcher accepts any all-digit string, so this rejects values like '1700000000000ms', '1.7e12', or negative signs. The regex also matches empty string, but the earlier hasText guard prevents that case.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java:205

    /**
     * 签名验证
     * @param appkey
     * @param signature
     * @param timestamp
     * @return
     */
    protected void checkSignValid(String appkey, String signature, String timestamp) {
        if (!StringUtils.hasText(appkey)) {
            throw new JeecgBootException("appkey为空");
        }
        if (!StringUtils.hasText(signature)) {
            throw new JeecgBootException("signature为空");
        }
        if (!StringUtils.hasText(timestamp)) {
            throw new JeecgBootException("timastamp时间戳为空");
        }
        if (!timestamp.matches("[0-9]*")) {
            throw new JeecgBootException("timastamp时间戳不合法");
        }
        if (System.currentTimeMillis() - Long.parseLong(timestamp) > 5 * 60 * 1000) {
            throw new JeecgBootException("signature签名已过期(超过五分钟)");
        }
    }

    /**
     * 认证信息核验
     * @param appKey
     * @param signature
     * @param timestamp
     * @param openApiAuth
     * @return
     * @throws Exception
     */
    protected void checkSignature(String appKey, String signature, String timestamp, OpenApiAuth openApiAuth) {
        if(openApiAuth==null){
            throw new JeecgBootException("不存在认证信息");

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Send timestamp as a pure-digit epoch-millis string, e.g. String.valueOf(System.currentTimeMillis()).
2. If the client uses seconds, multiply by 1000 and stringify.
3. Strip any non-digit characters before sending.

Example fix

// before: timestamp = "2026-08-13T10:00:00Z"
// after:  timestamp = String.valueOf(System.currentTimeMillis());  // e.g. "1755079200000"

// Reject any timestamp that is not pure digits
if (timestamp == null || !timestamp.matches("\\d+")) {
    throw new IllegalArgumentException("timestamp must be all-digit epoch millis");
}

When it happens

Trigger: Client sends timestamp as seconds vs milliseconds with units attached, as a float, or with timezone text; a JSON payload that stringifies a number with formatting.

Common situations: Client library formats Date as ISO-8601 or with 'Z' suffix; mixing second-precision and millisecond-precision conventions; localization that inserts separators.

Related errors

• appkey为空
• signature为空
• timastamp时间戳为空
• signature签名已过期(超过五分钟)
• 不存在认证信息

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/d60f283a2c9f632c. Report an issue: GitHub.