jwtbase64url
io.jsonwebtoken.io.DecodingException: Illegal base64url character: ' '
I am implementing signup, signin and logout function.
signup, signin is working. but, there is a problem in working logout.
here are my codes.
@Service
@Slf4j
@RequiredArgsConstructor
public class UserService {
private final UserRepository userRepository;
private final PasswordEncoder passwordEncoder;
private final JwtProvider jwtProvider;
private final RedisDao redisDao;
@Transactional
public ResponseEntity signup(@Valid SignUpRequest signUpRequest) {
String account = signUpRequest.getAccount();
String password = passwordEncoder.encode(signUpRequest.getPassword());
Optional<User> findAccount = userRepository.findByAccount(account);
if (findAccount.isPresent()) {
throw new CustomException(ExceptionStatus.DUPLICATED_ACCOUNT);
}
User user = signUpRequest.toEntity(Role.ROLE_USER, password);
userRepository.save(user);
return ResponseEntity.ok("회원가입 성공");
}
@Cacheable(cacheNames = CacheNames.LOGIN_USER, key = "'login'+ #p0.getAccount()", unless = "#result==null")
@Transactional
public UserResponse login(LoginRequest loginRequest) {
String account = loginRequest.getAccount();
String password = loginRequest.getPassword();
User user = userRepository.findByAccount(account).orElseThrow(() -> new CustomException(ExceptionStatus.WRONG_ACCOUNT));
if (!passwordEncoder.matches(password, user.getPassword())) {
throw new CustomException(ExceptionStatus.WRONG_PASSWORD);
}
return new UserResponse().of(user);
}
@CacheEvict(cacheNames = CacheNames.USER_BY_ACCOUNT, key = "'login' + #p1")
@Transactional
public ResponseEntity logout(String accessToken, String account) {
Long expiration = jwtProvider.getExpiration(accessToken);
redisDao.setBlackList(accessToken, "logout", expiration);
if (redisDao.hasKey(account)) {
redisDao.deleteRefreshToken(account);
} else {
throw new IllegalArgumentException("이미 로그아웃한 유저입니다.");
}
return ResponseEntity.ok("로그아웃 완료");
}
public UserResponse getUser(String account) throws Exception {
User user = userRepository.findByAccount(account).orElseThrow(() -> new Exception("계정을 찾을 수 없습니다."));
return UserResponse.of(user);
}
//
}
@Slf4j
@Component
@RequiredArgsConstructor
public class JwtProvider {
public static final String AUTHORIZATION_HEADER = "Authorization";
private static final String AUTHORIZATION_KEY = "auth";
private static final long ACCESS_TOKEN_TIME = 1000 * 60 * 30L;
private static final long REFRESH_TOKEN_TIME = 1000 * 60 * 60 * 24 * 7L;
@Value("${jwt.secret.key}")
private String secretKey;
private Key signature;
private final CustomUserDetailsService customUserDetailsService;
private final RedisDao redisDao;
@PostConstruct
public void init() {
byte[] bytes = Base64.getDecoder().decode(secretKey);
signature = Keys.hmacShaKeyFor(bytes);
}
public String resolveToken(HttpServletRequest request) {
return request.getHeader(AUTHORIZATION_HEADER);
}
private String createToken(String account, Role role, Long tokenExpireTime) {
Date date = new Date();
return Jwts.builder()
.claim(AUTHORIZATION_KEY, role)
.setSubject(account)
.setIssuedAt(date)
.setExpiration(new Date(date.getTime() + tokenExpireTime))
.signWith(signature, SignatureAlgorithm.HS256)
.compact();
}
public TokenResponse createTokenByLogin(String account, Role role) {
String accessToken = createToken(account, role, ACCESS_TOKEN_TIME);
String refreshToken = createToken(account, role, REFRESH_TOKEN_TIME);
redisDao.setRefreshToken(account, refreshToken, REFRESH_TOKEN_TIME);
return new TokenResponse(accessToken, refreshToken);
}
public TokenResponse reissueAtk(String account, Role role, String inputRefreshToken) {
if (!redisDao.getRefreshToken(account).equals(inputRefreshToken)) {
throw new CustomException(ExceptionStatus.AUTHENTICATION);
}
String accessToken = createToken(account, role, ACCESS_TOKEN_TIME);
String refreshToken = createToken(account, role, REFRESH_TOKEN_TIME);
redisDao.setRefreshToken(account, refreshToken, REFRESH_TOKEN_TIME);
return new TokenResponse(accessToken, refreshToken);
}
public Claims getClaimsFromToken(String token) {
return Jwts.parserBuilder().setSigningKey(signature).build()
.parseClaimsJws(token)
.getBody();
}
public boolean validateToken(String token) {
try {
if (!token.substring(0, "BEARER ".length()).equalsIgnoreCase("BEARER ")) {
return false;
} else {
token = token.split(" ")[1].trim();
}
Jwts.parserBuilder().setSigningKey(signature).build().parseClaimsJws(token);
return true;
} catch (SecurityException | MalformedJwtException | UnsupportedJwtException e) {
log.info("만료된 jwt 토큰 입니다.");
} catch (IllegalArgumentException e) {
log.info("잘못된 JWT 토큰 입니다.");
}
return false;
}
public Long getExpiration(String accessToken) {
Date expiration = Jwts.parserBuilder().setSigningKey(signature).build()
.parseClaimsJws(accessToken)
.getBody()
.getExpiration();
long now = new Date().getTime();
return (expiration.getTime() - now);
}
public Authentication createUserAuthentication(String account) {
UserDetails userDetails = customUserDetailsService.loadUserByUsername(account);
return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
}
}
@Configuration
@RequiredArgsConstructor
@EnableWebSecurity
//@EnableGlobalMethodSecurity(securedEnabled = true)
@EnableMethodSecurity
@EnableScheduling
public class SecurityConfig implements WebMvcConfigurer {
private final JwtProvider jwtProvider;
private final RedisDao redisDao;
private final CustomAccessDeniedHandler customAccessDeniedHandler;
private final CustomAuthenticationEntryPoint customAuthenticationEntryPoint;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.httpBasic(AbstractHttpConfigurer::disable)
.csrf(AbstractHttpConfigurer::disable)
.cors(c -> c.configurationSource(request -> {
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOrigins(List.of("*"));
config.setAllowedMethods(List.of("*"));
return config;
}))
.sessionManagement(configurer -> configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeRequests(authorizeRequests ->
authorizeRequests
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.requestMatchers("/signup", "/login").permitAll()
// .requestMatchers("/admin/**").hasRole("ADMIN")
// .requestMatchers("/user/**").hasRole("USER")
.anyRequest().denyAll()
)
.addFilterBefore(new JwtAuthenticationFilter(redisDao, jwtProvider), UsernamePasswordAuthenticationFilter.class)
.exceptionHandling(exceptionHandling -> exceptionHandling
.accessDeniedHandler(customAccessDeniedHandler)
.authenticationEntryPoint(customAuthenticationEntryPoint)
);
return http.build();
}
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("*")
.allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD")
.allowedOriginPatterns("*")
.exposedHeaders("Authorization");
}
}
I put access token in bearer token correctly. So it worked when I request "/login" POST
but when I request "/logout" DELETE it doesn't work!
showing accessToken fully, here it is.
eyJhbGciOiJIUzI1NiJ9.eyJhdXRoIjoiUk9MRV9VU0VSIiwic3ViIjoiYWFhYWEiLCJpYXQiOjE3MDU3NjMzMzYsImV4cCI6MTcwNTc2NTEzNn0.jKteJHNlcNU4Sh5EU1U6-ZaMhy6isFSaWtDiiJW63VE
here is error message
2024-01-21T00:17:29.664+09:00 ERROR 7822 --- [nio-8080-exec-7] o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception
io.jsonwebtoken.io.DecodingException: Illegal base64url character: ' '
at io.jsonwebtoken.io.Base64.ctoi(Base64.java:221) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.Base64.decodeFast(Base64.java:270) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.Base64Decoder.decode(Base64Decoder.java:36) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.Base64Decoder.decode(Base64Decoder.java:23) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.io.ExceptionPropagatingDecoder.decode(ExceptionPropagatingDecoder.java:36) ~[jjwt-api-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:309) ~[jjwt-impl-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:550) ~[jjwt-impl-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.DefaultJwtParser.parseClaimsJws(DefaultJwtParser.java:610) ~[jjwt-impl-0.11.2.jar:0.11.2]
at io.jsonwebtoken.impl.ImmutableJwtParser.parseClaimsJws(ImmutableJwtParser.java:173) ~[jjwt-impl-0.11.2.jar:0.11.2]
at kmu.likelion.webpage.user.jwt.JwtProvider.getClaimsFromToken(JwtProvider.java:89) ~[classes/:na]
at kmu.likelion.webpage.user.jwt.JwtAuthenticationFilter.doFilterInternal(JwtAuthenticationFilter.java:46) ~[classes/:na]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:107) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:93) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:82) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:69) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:62) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:233) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:191) ~[spring-security-web-6.2.1.jar:6.2.1]
at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:113) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.servlet.handler.HandlerMappingIntrospector.lambda$createCacheFilter$3(HandlerMappingIntrospector.java:195) ~[spring-webmvc-6.1.2.jar:6.1.2]
at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:113) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.CompositeFilter.doFilter(CompositeFilter.java:74) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.security.config.annotation.web.configuration.WebMvcSecurityConfiguration$CompositeFilterChainProxy.doFilter(WebMvcSecurityConfiguration.java:225) ~[spring-security-config-6.2.1.jar:6.2.1]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:352) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:268) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-6.1.2.jar:6.1.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.1.2.jar:6.1.2]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:340) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:896) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-10.1.17.jar:10.1.17]
at java.base/java.lang.Thread.run(Thread.java:1623) ~[na:na]
I think there is not whitespace(' ') in accessToken.
But why application can't encode accessToken?
Solution
I'm not sure, but it's maybe in your getExpiration method, you’re directly parsing the accessToken without splitting it. If the accessToken you’re passing to this method includes the Bearer prefix, this could be the source of the problem. The Bearer prefix is not part of the JWT token and should be removed before parsing the token.
how about this?
public Long getExpiration(String accessToken) {
// Remove the "Bearer " prefix if it exists
if (accessToken.startsWith("Bearer ")) {
accessToken = accessToken.substring(7);
}
Date expiration = Jwts.parserBuilder().setSigningKey(signature).build()
.parseClaimsJws(accessToken)
.getBody()
.getExpiration();
long now = new Date().getTime();
return (expiration.getTime() - now);
}
- Securing JWT tokens against attackers
- Spring Security issue with JWT: Cannot subclass final class JwtAuthenticationProvider
- How to avoid multiple token refresh requests when making simultaneous API requests with an expired token
- Google Cloud: sign a JWT while impersonating a service account
- How to generate a refresh token?
- How to avoid multiple refresh token call, if there are multiple API calls get unauthorized because access token expired
- Creating JWT in Coldfusion for google Service account
- Unexpected JWT alg received, expected RS256, got: HS256
- Why do I get a "io.jsonwebtoken.ExpiredJwtException"?
- .NET Core 3.1 GoogleSignIn -The authentication handler registered for scheme 'Bearer' is 'JwtBearerHandler' which cannot be used for SignInAsync
- JWT signature verification failing
- IDX10603: The algorithm: 'HS256' requires the SecurityKey.KeySize to be greater than '128' bits. KeySize reported: '32'. Parameter name: key.KeySize
- How can I securize my code-first gRPC endpoints using Azure Authentication?
- AWS Lambda Custom JWT Validation
- Flask JWT Extended missing csrf access token
- Where should I refresh my JWT in SvelteKit
- Token is generated at the endpoint but does not arrive on the page
- Is it okay to encrypt a 3rd party access token and refresh token, in an encrypted JWT?
- In JWT Authentication in .NET 7, how can a "validated" token be "missing"?
- What to validate 'iat' and 'sub' claims of a JWT against?
- How to use jti claim in a JWT
- Can't import jwt-decode in JavaScript file in React project
- JWT and CSRF differences
- Getting 'secretOrPrivateKey must have a value' error in NestJS JWT authentication
- Google Sheets, JWT client with Service Account
- Angular 17 & dot net Core 8 - Jwt on refresh adding to Audience
- Is "scope" a standard claim?
- Error when trying to Promisify JWT in Typescript
- reactjs call multiple axios posts in one async function
- TS2339: Property 'scope' does not exist on type 'JwtPayload'