jeecgboot/JeecgBoot · error · AuthenticationException

Token非法无效!

Error message

Token非法无效!

What it means

Thrown by ShiroRealm.checkUserTokenIsEffect() when JwtUtil.getUsername(token) returns null — the JWT token cannot be decoded to extract a username. This means the token is structurally invalid, corrupted, signed with a different secret, or not a valid JWT at all. The method uses JwtUtil (jjwt library) to parse the token and extract the 'username' claim.

Source

Thrown at jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/config/shiro/ShiroRealm.java:128

            loginUser = this.checkUserTokenIsEffect(token);
        } catch (AuthenticationException e) {
            log.error("—————校验 check token 失败——————————"+ e.getMessage(), e);
            // 重新抛出异常，让JwtFilter统一处理，避免返回两次错误响应
            throw e;
        }
        return new SimpleAuthenticationInfo(loginUser, token, getName());
    }

    /**
     * 校验token的有效性
     *
     * @param token
     */
    public LoginUser checkUserTokenIsEffect(String token) throws AuthenticationException {
        // 解密获得username，用于和数据库进行对比
        String username = JwtUtil.getUsername(token);
        if (username == null) {
            throw new AuthenticationException("Token非法无效!");
        }

        // 查询用户信息
        log.debug("———校验token是否有效————checkUserTokenIsEffect——————— "+ token);
        LoginUser loginUser = TokenUtils.getLoginUser(username, commonApi, redisUtil);
        //LoginUser loginUser = commonApi.getUserByName(username);
        if (loginUser == null) {
            throw new AuthenticationException("用户不存在!");
        }
        // 判断用户状态
        if (loginUser.getStatus() != 1) {
            throw new AuthenticationException("账号已被锁定,请联系管理员!");
        }
        // 校验token是否超时失效 & 或者账号密码是否错误
        if (!jwtTokenRefresh(token, username, loginUser.getPassword())) {
            // 用户登录Token过期提示信息
            String userLoginTokenErrorMsg = oConvertUtils.getString(redisUtil.get(CommonConstant.PREFIX_USER_TOKEN_ERROR_MSG + token));
            throw new AuthenticationException(oConvertUtils.isEmpty(userLoginTokenErrorMsg)? CommonConstant.TOKEN_IS_INVALID_MSG: userLoginTokenErrorMsg);

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. Have the user log out and log in again to obtain a fresh token signed with the current server secret.
  2. Verify that the JWT signing secret (jeecg.jwt.secret in application.yml) is consistent across all environments and instances.
  3. Check that the token is not truncated — inspect the header value for completeness (three base64 segments separated by dots).
  4. Ensure the JwtUtil implementation matches between token generation and validation (same library version, same claim names).

Example fix

// No code fix — user must re-authenticate.
// Verify JWT secret consistency:
// application-dev.yml:
//   jeecg:
//     jwt:
//       secret: <same-secret-in-all-envs>
// Front-end: on 401 with 'Token非法无效', force logout and redirect to /login
Defensive patterns

Strategy: try-catch

Validate before calling

// Verify token structure before sending (front-end)
function isValidJwt(token) {
    const parts = token.split('.');
    return parts.length === 3;
}
if (!isValidJwt(token)) {
    // re-authenticate
}

Try / catch

// Handled by JwtFilter — returns 401 with token error message
// Front-end: on 401 'Token非法无效', force logout:
axios.interceptors.response.use(null, error => {
    if (error.response?.status === 401 && error.response.data?.message?.includes('非法无效')) {
        store.dispatch('Logout');
        router.push('/user/login');
    }
});

Prevention

When it happens

Trigger: Token is a random string (not a JWT); token is a JWT but signed with a different secret (e.g., after server restart with a new secret, or environment mismatch); token is truncated or has extra characters; token payload does not contain a 'username' claim.

Common situations: Server's JWT signing secret was changed (jeecg.jwt.secret config) invalidating all existing tokens; token was manually modified by the user; environment migration (dev→prod) with different secrets; token from a different JeecgBoot instance; clock skew causing JWT parsing issues.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/de217191069f3f78. Report an issue: GitHub.