如何修复负载为空的JWT Token验证报错问题？

问题背景 #

现有JWT验证代码在Payload非空时运行正常，但遇到空Payload的Token时会抛出"Body/Payload is missing"错误，而jwt.io可以正常验证该Token。

空Payload示例Token #

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..eoZhroqrfGu9P5dEeCceFZ8oG3XUlvOS6vKUSp4dwO86p_DDy_blNSvez3QLQBgxmaL_VRXxPNXBpDKIc3FHa9vmbEligItW5mrtamAlt_NrvSuXBYMhJrUkc6GHamVHYF4-g7PrrgycevIFCmoquZY1bUr0gb0Foo50oPhcA5vO2DMso6PuevdFQ2NBH5uSdHteRfClR1KjxUzguNm4a0FafMKj5oM6d1p4HVanUMyR8LJMduqrEuSfTPXxV_hVz2pYqxibQ3u9U2_BbHLt0Phmq8ENG_arxd0nY4VDnUq8WpydhR2Q8ilHEOQjG4tvkLrdstgwWJaMLJtzr-xAFw

当前验证代码 #

import io.jsonwebtoken.*;
public static boolean verify(String jwtToken, String publicKeyString) throws Exception {
    
    
        try {
            byte[] publicKeyBytes = Base64.getDecoder().decode(publicKeyString
                    .replace("-----BEGIN PUBLIC KEY-----", "")
                    .replace("-----END PUBLIC KEY-----", "")
                    .replaceAll("\\s+", ""));

            X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes);
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            PublicKey publicKey = keyFactory.generatePublic(keySpec);


            Jws<Claims> claimsJws = Jwts.parserBuilder()
                    .setSigningKey(publicKey)
                    .build()
                    .parseClaimsJws(jwtToken);
            return true;

        } catch (Exception e) {
           e.printStackTrace();
            return false;
        }
    }

问题原因 #

JJWT库默认不允许空Payload，但JWT标准本身支持空Payload格式（即Token的第二部分为空，两个点直接相连）。

修复方案 #

在构建JWT解析器时，添加allowEmptyPayload()配置项，开启空Payload的支持。

修改后的代码 #

import io.jsonwebtoken.*;
public static boolean verify(String jwtToken, String publicKeyString) throws Exception {
    
        try {
            byte[] publicKeyBytes = Base64.getDecoder().decode(publicKeyString
                    .replace("-----BEGIN PUBLIC KEY-----", "")
                    .replace("-----END PUBLIC KEY-----", "")
                    .replaceAll("\\s+", ""));

            X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes);
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            PublicKey publicKey = keyFactory.generatePublic(keySpec);

            // 关键配置：允许空Payload
            Jws<Claims> claimsJws = Jwts.parserBuilder()
                    .setSigningKey(publicKey)
                    .allowEmptyPayload() // 添加该行开启空Payload支持
                    .build()
                    .parseClaimsJws(jwtToken);
            return true;

        } catch (Exception e) {
           e.printStackTrace();
            return false;
        }
    }

说明 #

• allowEmptyPayload()是JJWT提供的官方配置，专门用于兼容符合标准的空Payload场景
• 添加该配置后，空Payload的Token可正常通过验证，同时不影响非空Payload的原有验证逻辑

内容的提问来源于stack exchange，提问作者Rahul Raj