jeecgboot/JeecgBoot · error · AuthenticationException
token为空!
Error message
token为空!
What it means
Thrown by ShiroRealm.doGetAuthenticationInfo() when the JWT token extracted from the authentication credential is null. This is the entry point of Shiro authentication — it means no token was provided in the request at all. The error is logged with the client's IP address and request URL before throwing. The JwtFilter upstream typically catches this and returns a 401 response.
Source
Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/config/shiro/ShiroRealm.java:105
return info;
}
/**
* 用户信息认证是在用户进行登录的时候进行验证(不存redis)
* 也就是说验证用户输入的账号和密码是否正确，错误抛出异常
*
* @param auth 用户登录的账号密码信息
* @return 返回封装了用户信息的 AuthenticationInfo 实例
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {
log.debug("===============Shiro身份认证开始============doGetAuthenticationInfo==========");
String token = (String) auth.getCredentials();
if (token == null) {
HttpServletRequest req = SpringContextUtils.getHttpServletRequest();
log.info("————————身份认证失败——————————IP地址: "+ oConvertUtils.getIpAddrByRequest(req) +"，URL:"+req.getRequestURI());
throw new AuthenticationException("token为空!");
}
// 校验token有效性
LoginUser loginUser = null;
try {
loginUser = this.checkUserTokenIsEffect(token);
} catch (AuthenticationException e) {
log.error("—————校验 check token 失败——————————"+ e.getMessage(), e);
// 重新抛出异常，让JwtFilter统一处理，避免返回两次错误响应
throw e;
}
return new SimpleAuthenticationInfo(loginUser, token, getName());
}
/**
* 校验token的有效性
*
* @param token
*/View on GitHub (pinned to 96fb33f5ec)
Solutions
- Ensure the front-end sends the 'X-Access-Token' header (or the configured token header) on every authenticated request.
- Check the Shiro filter chain configuration (ShiroConfig) — if the endpoint should be public, add it to the 'anon' filter map.
- Verify the JwtFilter correctly extracts the token from the request header before creating the AuthenticationToken.
- Handle 401 responses in the front-end by redirecting to the login page.
Example fix
// No code fix in the backend — this is correct behavior.
// Front-end fix: ensure token is attached:
// axios interceptor
axios.interceptors.request.use(config => {
const token = localStorage.getItem('Access-Token');
if (token) {
config.headers['X-Access-Token'] = token;
}
return config;
});
// Backend: if the endpoint should be public, configure ShiroConfig:
// filterChainDefinitionMap.put("/api/public/**", "anon"); Defensive patterns
Strategy: validation
Validate before calling
// Front-end: ensure token is present before making API calls
const token = localStorage.getItem('Access-Token');
if (!token) {
router.push('/user/login');
return;
}
// Attach to request header
config.headers['X-Access-Token'] = token; Try / catch
// Handled by JwtFilter / global exception handler — returns 401
// Front-end interceptor:
axios.interceptors.response.use(null, error => {
if (error.response?.status === 401) {
router.push('/user/login');
}
}); Prevention
- Attach the token header on every authenticated API request via an axios/fetch interceptor.
- Add public endpoints to the Shiro 'anon' filter chain if they should not require authentication.
- Handle 401 responses in the front-end by redirecting to login.
When it happens
Trigger: An API request without an 'X-Access-Token' / 'Authorization' header; a WebSocket connection attempt without a token; a request where the Shiro token credential is set to null by the JwtFilter (e.g., token header present but empty string was not parsed into the AuthenticationToken).
Common situations: Front-end fails to attach the token header after login page redirect; token was cleared from localStorage by the browser; API is accessed directly (e.g., via curl, Postman) without authentication; a public/anonymous request reaches a protected endpoint that is not in the Shiro filter chain's anon list.
Related errors
AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14).
Data as JSON: /api/errors/3d3dd8dc48eba79f.
Report an issue: GitHub.