io.jsonwebtoken.io.DecodingException: Illegal base64url character: ' '
I am implementing signup, signin and logout function.
signup, signin is working. but, there is a problem in working logout.
here are my codes.
@Service
@Slf4j
@RequiredArgsConstructor
public class UserService {
private final UserRepository userRepository;
private final PasswordEncoder passwordEncoder;
private final JwtProvider jwtProvider;
private final RedisDao redisDao;
@Transactional
public ResponseEntity signup(@Valid SignUpRequest signUpRequest) {
String account = signUpRequest.getAccount();
String password = passwordEncoder.encode(signUpRequest.getPassword());
Optional<User> findAccount = userRepository.findByAccount(account);
if (findAccount.isPresent()) {
throw new CustomException(ExceptionStatus.DUPLICATED_ACCOUNT);
}
User user = signUpRequest.toEntity(Role.ROLE_USER, password);
userRepository.save(user);
return ResponseEntity.ok("회원가입 성공");
}
@Cacheable(cacheNames = CacheNames.LOGIN_USER, key = "'login'+ #p0.getAccount()", unless = "#result==null")
@Transactional
public UserResponse login(LoginRequest loginRequest) {
String account = loginRequest.getAccount();
String password = loginRequest.getPassword();
User user = userRepository.findByAccount(account).orElseThrow(() -> new CustomException(ExceptionStatus.WRONG_ACCOUNT));
if (!passwordEncoder.matches(password, user.getPassword())) {
throw new CustomException(ExceptionStatus.WRONG_PASSWORD);
}
return new UserResponse().of(user);
}
@CacheEvict(cacheNames = CacheNames.USER_BY_ACCOUNT, key = "'login' + #p1")
@Transactional
public ResponseEntity logout(String accessToken, String account) {
Long expiration = jwtProvider.getExpiration(accessToken);
redisDao.setBlackList(accessToken, "logout", expiration);
if (redisDao.hasKey(account)) {
redisDao.deleteRefreshToken(account);
} else {
throw new IllegalArgumentException("이미 로그아웃한 유저입니다.");
}
return ResponseEntity.ok("로그아웃 완료");
}
public UserResponse getUser(String account) throws Exception {
User user = userRepository.findByAccount(account).orElseThrow(() -> new Exception("계정을 찾을 수 없습니다."));
return UserResponse.of(user);
}
//
}
@Slf4j
@Component
@RequiredArgsConstructor
public class JwtProvider {
public static final String AUTHORIZATION_HEADER = "Authorization";
private static final String AUTHORIZATION_KEY = "auth";
private static final long ACCESS_TOKEN_TIME = 1000 * 60 * 30L;
private static final long REFRESH_TOKEN_TIME = 1000 * 60 * 60 * 24 * 7L;
@Value("${jwt.secret.key}")
private String secretKey;
private Key signature;
private final CustomUserDetailsService customUserDetailsService;
private final RedisDao redisDao;
@PostConstruct
public void init() {
byte[] bytes = Base64.getDecoder().decode(secretKey);
signature = Keys.hmacShaKeyFor(bytes);
}
public String resolveToken(HttpServletRequest request) {
return request.getHeader(AUTHORIZATION_HEADER);
}
private String createToken(String account, Role role, Long tokenExpireTime) {
Date date = new Date();
return Jwts.builder()
.claim(AUTHORIZATION_KEY, role)
.setSubject(account)
.setIssuedAt(date)
.setExpiration(new Date(date.getTime() + tokenExpireTime))
.signWith(signature, SignatureAlgorithm.HS256)
.compact();
}
public TokenResponse createTokenByLogin(String account, Role role) {
String accessToken = createToken(account, role, ACCESS_TOKEN_TIME);
String refreshToken = createToken(account, role, REFRESH_TOKEN_TIME);
redisDao.setRefreshToken(account, refreshToken, REFRESH_TOKEN_TIME);
return new TokenResponse(accessToken, refreshToken);
}
public TokenResponse reissueAtk(String account, Role role, String inputRefreshToken) {
if (!redisDao.getRefreshToken(account).equals(inputRefreshToken)) {
throw new CustomException(ExceptionStatus.AUTHENTICATION);
}
String accessToken = createToken(account, role, ACCESS_TOKEN_TIME);
String refreshToken = createToken(account, role, REFRESH_TOKEN_TIME);
redisDao.setRefreshToken(account, refreshToken, REFRESH_TOKEN_TIME);
return new TokenResponse(accessToken, refreshToken);
}
public Claims getClaimsFromToken(String token) {
return Jwts.parserBuilder().setSigningKey(signature).build()
.parseClaimsJws(token)
.getBody();
}
public boolean validateToken(String token) {
try {
if (!token.substring(0, "BEARER ".length()).equalsIgnoreCase("BEARER ")) {
return false;
} else {
token = token.split(" ")[1].trim();
}
Jwts.parserBuilder().setSigningKey(signature).build().parseClaimsJws(token);
return true;
} catch (SecurityException | MalformedJwtException | UnsupportedJwtException e) {
log.info("만료된 jwt 토큰 입니다.");
} catch (IllegalArgumentException e) {
log.info("잘못된 JWT 토큰 입니다.");
}
return false;
}
public Long getExpiration(String accessToken) {
Date expiration = Jwts.parserBuilder().setSigningKey(signature).build()
.parseClaimsJws(accessToken)
.getBody()
.getExpiration();
long now = new Date().getTime();
return (expiration.getTime() - now);
}
public Authentication createUserAuthentication(String account) {
UserDetails userDetails = customUserDetailsService.loadUserByUsername(account);
return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
}
}
@Configuration
@RequiredArgsConstructor
@EnableWebSecurity
//@EnableGlobalMethodSecurity(securedEnabled = true)
@EnableMethodSecurity
@EnableScheduling
public class SecurityConfig implements WebMvcConfigurer {
private final JwtProvider jwtProvider;
private final RedisDao redisDao;
private final CustomAccessDeniedHandler customAccessDeniedHandler;
private final CustomAuthenticationEntryPoint customAuthenticationEntryPoint;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.httpBasic(AbstractHttpConfigurer::disable)
.csrf(AbstractHttpConfigurer::disable)
.cors(c -> c.configurationSource(request -> {
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOrigins(List.of("*"));
config.setAllowedMethods(List.of("*"));
return config;
}))
.sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeRequests(authorizeRequests ->
authorizeRequests
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.requestMatchers("/signup", "/login").permitAll()
// .requestMatchers("/admin/**").hasRole("ADMIN")
// .requestMatchers("/user/**").hasRole("USER")
.anyRequest().denyAll()
)
.addFilterBefore(new JwtAuthenticationFilter(redisDao, jwtProvider), UsernamePasswordAuthenticationFilter.class)
.exceptionHandling(exceptionHandling -> exceptionHandling
.accessDeniedHandler(customAccessDeniedHandler)
.authenticationEntryPoint(customAuthenticationEntryPoint)
);
return http.build();
}
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("*")
.allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD")
.allowedOriginPatterns("*")
.exposedHeaders("Authorization");
}
}
I put access token in bearer token correctly. So it worked when I request "/login" POST
but when I request "/logout" DELETE it doesn't work!
showing accessToken fully, here it is.
eyJhbGciOiJIUzI1NiJ9.eyJhdXRoIjoiUk9MRV9VU0VSIiwic3ViIjoiYWFhYWEiLCJpYXQiOjE3MDU3NjMzMzYsImV4cCI6MTcwNTc2NTEzNn0.jKteJHNlcNU4Sh5EU1U6-ZaMhy6isFSaWtDiiJW63VE
here is error message
2024-01-21T00:17:29.664+09:00 ERROR 7822 --- [nio-8080-exec-7] o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception
io.jsonwebtoken.io.DecodingException: Illegal base64url character: ' '
at io.jsonwebtoken.io.Base64.ctoi(Base64.java:221) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.Base64.decodeFast(Base64.java:270) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.Base64Decoder.decode(Base64Decoder.java:36) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.Base64Decoder.decode(Base64Decoder.java:23) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.ExceptionPropagatingDecoder.decode(ExceptionPropagatingDecoder.java:36) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:309) ~[jjwt-impl-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:550) ~[jjwt-impl-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.DefaultJwtParser.parseClaimsJws(DefaultJwtParser.java:610) ~[jjwt-impl-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.ImmutableJwtParser.parseClaimsJws(ImmutableJwtParser.java:173) ~[jjwt-impl-0.11.2.jar:0.11.2]
at kmu.likelion.webpage.user.jwt.JwtProvider.getClaimsFromToken(JwtProvider.java:89) ~[classes/:na]
at kmu.likelion.webpage.user.jwt.JwtAuthenticationFilter.doFilterInternal(JwtAuthenticationFilter.java:46) ~[classes/:na]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:107) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:93) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:82) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:69) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:62) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:233) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:191) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:113) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.servlet.handler.HandlerMappingIntrospector.lambda$createCacheFilter$3(HandlerMappingIntrospector.java:195) ~[spring-webmvc-6.1.2.jar:6.1.2]
at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:113) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.CompositeFilter.doFilter(CompositeFilter.java:74) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.config.annotation.web.configuration.WebMvcSecurityConfiguration$CompositeFilterChainProxy.doFilter(WebMvcSecurityConfiguration.java:225) ~[spring-security-config-6.2.1.jar:6.2.1]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:352) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:268) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:340) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:896) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at java.base/java.lang.Thread.run(Thread.java:1623) ~[na:na]
I think there is not whitespace(' ') in accessToken.
But why application can't encode accessToken?
Solution
I'm not sure, but it's maybe in your getExpiration method, you’re directly parsing the accessToken without splitting it. If the accessToken you’re passing to this method includes the Bearer prefix, this could be the source of the problem. The Bearer prefix is not part of the JWT token and should be removed before parsing the token.
how about this?
public Long getExpiration(String accessToken) {
// Remove the "Bearer " prefix if it exists
if (accessToken.startsWith("Bearer ")) {
accessToken = accessToken.substring(7);
}
Date expiration = Jwts.parserBuilder().setSigningKey(signature).build()
.parseClaimsJws(accessToken)
.getBody()
.getExpiration();
long now = new Date().getTime();
return (expiration.getTime() - now);
}
- Node js JWT to verify token using Google's public keys
- 401 Unauthorized Error with JWT Authentication in .NET 8 and Vue.js Application
- How to generate JWT in PHP
- Generating JWT token with JwtUtil class in Spring Boot resulting in NullPointerException
- .NET8 ASP.NET Core Web API : JWT error : Bearer error="invalid_token"
- Validate Apple StoreKit2 in-app purchase receipt jwsRepresentation in backend (node ideally, but anything works)
- Getting 403 from Google Cloud Monitoring API using a service account and JWT auth
- Can't import jwt-decode in JavaScript file in React project
- authentication json web token springboot angular
- CSRF and JWT With Sping Security 6 Stateless REST
- Django channels authentication with http post and use websockes after
- Spring boot Jwt signed with RS256
- Bypass JWT Authentication with NginX so i can use Authentik Reverse Proxy Authentication
- Why do I get IDX20803 error after upgrading to IdentityModel v7 from v6?
- What is the correct way to obtain an instance of the authenticated user if I'm using a JWT
- Can Firebase Auth custom claims in JWT tokens be tampered with in onCall functions?
- JWT, is it safe to use the same key pair to sign from server-side and encrypt from client-side?
- CORS Preflight Failing for SignalR Connection in ASP.NET Core with HttpOnly Cookie Authentication
- Username/password JWT with Salesforce Named Credentials
- Cors headers are set when run locally but not with traefik
- Token handler unable to convert the token to jwt token
- Use JWT to authenticate separate API Microservice
- JWT Validation fails
- Padding in RSA JWT signatures
- Authenticating an application server with a backend server
- Generating your OAuth Linkedin token : Oops. We can’t verify the authenticity of your request because the state parameter was modified
- How to strip sensitive information from exception message in c#
- HTTP 403 errors after update to .NET 8
- Mutliple JWT generation with different django secrets based on subdomains
- laravel 11 Target class [role] does not exist ( spatie/laravel-permission)