io.jsonwebtoken.SignatureException: JWT signature does not match locally computed signature. JWT val

怼烎@ 2024-03-25 20:27 55阅读 0赞

![d4a67f9e5de4428598fe68a7b421c7d4.png][]

> io.jsonwebtoken.SignatureException: JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted.  
> at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:354)  
> at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:481)  
> at io.jsonwebtoken.impl.DefaultJwtParser.parseClaimsJws(DefaultJwtParser.java:541)  
> at com.example.mz.helpwork.util.JwtUtil.parseJWT(JwtUtil.java:107)  
> at com.example.mz.helpwork.config.jwt.JwtAuthenticationTokenFilter.doFilterInternal(JwtAuthenticationTokenFilter.java:39)  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
> at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
> at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92)  
> at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77)  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
> at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
> at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
> at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)  
> at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)  
> at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)  
> at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)  
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)  
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)  
> at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)  
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)  
> at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)  
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)  
> at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)  
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)  
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)  
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)  
> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)  
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)  
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)  
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)  
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)  
> at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)  
> at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)  
> at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)  
> at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1594)  
> at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)  
> at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)  
> at java.lang.Thread.run(Thread.java:750)  
> 11:27:19 ERROR Servlet.service() for servlet \[dispatcherServlet\] in context with path \[/helpwork\] threw exception  
> java.lang.RuntimeException: token非法

这个报错翻译成大白话就是io.jsonwebtoken.SignatureException：JWT签名与本地计算的签名不匹配。JWT的有效性无法断言，也不应受到信任。

我是在我的项目中引入springsecurity+jwt时出现的问题

当遇到这个问题的时候，首先是打断点，判断是哪里出现了问题，我的项目在我生成token的时候是没有任何问题的，就是到解析的时候，解析不出来，直接抛出异常。当然针对这个问题，有两种解决方案：更改jwt的工具类；改解析token的代码

当然，我选择的是前者

可以参考我的jwt工具类

//    这个方法的作用是生成令牌字符串，根据userId生成，生成令牌三个素材：密钥 过期时间 userId
        public String createToken(int userId){
    //        对日期做偏移，算一下5天后的日期。new Date()是当前日期 DateField.DAY_OF_YEAR是偏移单位
    //        date是偏移之后的日期
            Date date=DateUtil.offset(new Date(), DateField.DAY_OF_YEAR,expire);
    //       创建加密算法密钥的对象，调用Algorithm.HMAC256(secret)的静态工厂方法创建对象
            Algorithm algorithm=Algorithm.HMAC256(secret);
    //        执行加密
            JWTCreator.Builder builder= JWT.create();
            String token=builder.withClaim("userId",userId).withExpiresAt(date).sign(algorithm);
            return token;
        }
    
        //    通过令牌解密出userId
        public int getUserId(String token){
    //        解码的对象
            DecodedJWT jwt=JWT.decode(token);
    //        通过属性名反向得到userid，asInt()是数据类型
            int userId=jwt.getClaim("userId").asInt();
            return userId;
        }
    
        //    验证令牌，没有返回值，失败抛异常
        public void verifierToken(String token){
    //        创建算法对象
            Algorithm algorithm=Algorithm.HMAC256(secret);
    //        用算法对象进行解密
            JWTVerifier verifier=JWT.require(algorithm).build();
    //        调用验证方法，传入token
            verifier.verify(token);
        }

最终的结果就是解析成功的，如图

![6c5ccc366af04947b9b1ff4cb2fc8aa5.png][]

[d4a67f9e5de4428598fe68a7b421c7d4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/aa8bc0b0d24c4243af4048a73588356a.png
[6c5ccc366af04947b9b1ff4cb2fc8aa5.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/72604ec018544bf9907e3c609bbb20a6.png