spring-projects/spring-security · error · IllegalArgumentException
Iterations value must be greater than zero
Error message
Iterations value must be greater than zero
What it means
Digester.setIterations throws this IllegalArgumentException when the configured iteration count is zero or negative. Spring Security's Digester performs hash-derived key stretching by repeatedly applying a MessageDigest, so a non-positive iteration count is meaningless and would silently weaken or break hashing. The library fails fast at configuration time rather than producing unusable digests.
Source
Thrown at crypto/src/main/java/org/springframework/security/crypto/password/Digester.java:59
*/
Digester(String algorithm, int iterations) {
// eagerly validate the algorithm
createDigest(algorithm);
this.algorithm = algorithm;
setIterations(iterations);
}
byte[] digest(byte[] value) {
MessageDigest messageDigest = createDigest(this.algorithm);
for (int i = 0; i < this.iterations; i++) {
value = messageDigest.digest(value);
}
return value;
}
void setIterations(int iterations) {
if (iterations <= 0) {
throw new IllegalArgumentException("Iterations value must be greater than zero");
}
this.iterations = iterations;
}
private static MessageDigest createDigest(String algorithm) {
try {
return MessageDigest.getInstance(algorithm);
}
catch (NoSuchAlgorithmException ex) {
throw new IllegalStateException("No such hashing algorithm", ex);
}
}
}
View on GitHub (pinned to 96852e8860)
Solutions
- Pass a strictly positive iteration count (e.g. setIterations(1024) or higher per your security requirements).
- Clamp or validate any externally supplied value before calling setIterations: if (iterations > 0) digester.setIterations(iterations);
- Check the configuration source for a missing/unset property defaulting to 0 and set a sane default.
Example fix
// before digester.setIterations(config.getIterations()); // 0 when property missing // after int iterations = Math.max(config.getIterations(), 1024); digester.setIterations(iterations);
Defensive patterns
Strategy: validation
Validate before calling
if (iterations <= 0) throw new IllegalArgumentException("iterations must be > 0");
digester.setIterations(iterations); Prevention
- Default iteration counts in config loaders (e.g. 1024) so missing properties never yield 0.
- Parse iteration counts with explicit bounds checking at the configuration boundary.
When it happens
Trigger: Calling setIterations(0) or setIterations(negative) on a Digester instance, or constructing a password encoder that forwards a non-positive iterations value into Digester.
Common situations: Loading an iteration count from external configuration (properties, YAML, environment) that is unset (0) or a mis-parsed negative value; a refactor or test that mistakenly disables iterations by setting them to 0.
Understand the failure class
Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.
Related errors
- No such hashing algorithm
- No SHA implementation available!
- Could not create hash
- Cpu cost parameter must be > 1.
- Cannot apply {configurer} to already built object
AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10).
Data as JSON: /api/errors/b7d51e47c3eacda4.
Report an issue: GitHub.