paascloud/paascloud-master · error · HttpAesException

解密失败

Error message

解密失败

What it means

HttpAesUtil.decrypt throws HttpAesException('解密失败') when the underlying JCE Cipher fails to decrypt the given content with the provided AES key and IV. Any exception from cipher.doFinal (wrong key, corrupted or non-padded ciphertext, bad IV) is caught, logged as '解密密码失败', and rethrown with this generic message. The original cause is not attached, so check the log for '解密密码失败' to see the real reason.

Solutions

1. Verify the decrypt key is byte-for-byte identical to the key used for encryption (check config/env on both sides).
2. Confirm the ciphertext was not altered by transport (URL-decode/unescape it before decrypting).
3. Ensure the same transformation (AES/CBC/PKCS5Padding) and IV are used on both encrypt and decrypt sides.
4. Catch HttpAesException and log the '解密密码失败' stack trace to identify the underlying BadPaddingException/IllegalBlockSizeException.
5. Validate key length is 16/24/32 bytes for AES-128/192/256.

Example fix

// before
String plain = HttpAesUtil.decrypt(cipherText, key);
// after
String plain;
try {
    plain = HttpAesUtil.decrypt(cipherText, key);
} catch (HttpAesException e) {
    log.error("AES decrypt failed, check key/IV/ciphertext", e);
    throw new BadRequestException("Invalid encrypted payload");
}

if (cipherText == null || cipherText.trim().isEmpty()) { throw new IllegalArgumentException("empty ciphertext"); }
if (key == null || !(key.length()==16||key.length()==24||key.length()==32)) { throw new IllegalArgumentException("invalid AES key length"); }

try {
    String plain = HttpAesUtil.decrypt(cipherText, key);
} catch (HttpAesException e) {
    log.error("AES decrypt failed for payload", e);
    throw new BadRequestException("Invalid encrypted payload");
}

When it happens

Trigger: Calling HttpAesUtil.decrypt(content, key) with ciphertext encrypted using a different key, a wrong Base64/string encoding, a mismatched IV, or content truncated/tampered in transit. Also thrown when the key string length is not a valid AES size for the encrypted data.

Common situations: Client and server using different AES keys after a key rotation; data encrypted with AES/CBC but decrypted assuming another padding; ciphertext passed through URL encoding or JSON escaping that altered it; wrong charset conversion corrupting the Base64 payload.

Related errors

• 加密失败
• UAC10011031
• Authentication method not supported:
• 无法获取用户信息
• 无法找到缓存的用户社交账号信息

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/dbb48f2fbbbb3c6c. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-common/paascloud-common-util/src/main/java/com/paascloud/HttpAesUtil.java:104

			byte[] content = new BASE64Decoder().decodeBuffer(contentParam);
			byte[] key = keyParam.getBytes(CHAR_SET);
			byte[] iv = ivParam.getBytes(CHAR_SET);

			if (md5Key) {
				MessageDigest md = MessageDigest.getInstance("MD5");
				key = md.digest(key);
			}
			SecretKeySpec skeySpec = new SecretKeySpec(key, "AES");
			//"算法/模式/补码方式"
			Cipher cipher = Cipher.getInstance("AES/CBC/ISO10126Padding");
			//使用CBC模式, 需要一个向量iv, 可增加加密算法的强度
			IvParameterSpec ivps = new IvParameterSpec(iv);
			cipher.init(Cipher.DECRYPT_MODE, skeySpec, ivps);
			byte[] bytes = cipher.doFinal(content);
			return new String(bytes, CHAR_SET);
		} catch (Exception ex) {
			log.error("解密密码失败", ex);
			throw new HttpAesException("解密失败");
		}
	}
}

View on GitHub (pinned to 781281a950)