"javax.crypto.BadPaddingException" warning in server console.
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
Legacy Article
You are viewing an article from our legacy "FastTrack"
publication program, made available for informational purposes. Articles
in this program were published without a requirement for independent
editing or verification and are provided"as is" without
guarantee.
Before using any information from this article, independently verify its
suitability for your situation and project.
Issue
- While startup below warnings can be observed in the server console:
ERROR [tomcat-http--1][AutoLoginFilter:259] Current URL / generates exception: com.liferay.portal.kernel.exception.SystemException: com.liferay.petra.encryptor.EncryptorException: com.liferay.petra.encryptor.EncryptorException: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
Caused by: com.liferay.petra.encryptor.EncryptorException: com.liferay.petra.encryptor.EncryptorException: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
Resolution
-
This is a WARN message thrown because when "Remember Me" is on,
com.liferay.portal.security.auth.RememberMeAutoLogin.doLogin(HttpServletRequest, HttpServletResponse) it sets some COOKIES into the response. Also, when a portal is started, a default Company will be created and each company has a unique "key_" field that is used to encrypt/decrypt data across the company instance. When logging in, the browser keeps these COOKIES so they will be re-sent to the server when you hit the page next time.
-
However, when we take another instance it will have a different "key_' object which means, a message that was encrypted previously with key X cannot be decrypted by key Y. It would be a security issue if this would not happen. Hence, when
com.liferay.portal.security.auth.RememberMeAutoLogin.doLogin attempts to decrypt the data from the request, it fails in com.liferay.portal.service.impl.UserLocalServiceImpl.decryptUserId(long, String, String)
- So in order to resolve the issue clear the browser cookies from the machine where the instance has been placed, one can also check the same behaviour with a new browser that does not have any kind of cookies doing this so will resolve the issue.
Did this article resolve your issue ?