From 427a8cb79ffaed4b3765007d6ab981924e9a8233 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=BB=84=E8=87=AA=E8=BE=BE?= <980324341@qq.com>
Date: Tue, 25 Aug 2026 22:00:30 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9AJWT=20=E5=AF=86?=
 =?UTF-8?q?=E9=92=A5=E6=9C=AA=E9=85=8D=E7=BD=AE=E6=97=B6=E4=BD=BF=E7=94=A8?=
 =?UTF-8?q?=E5=86=85=E7=BD=AE=E9=BB=98=E8=AE=A4=E5=AF=86=E9=92=A5=EF=BC=8C?=
 =?UTF-8?q?=E4=B8=8E=E6=A1=8C=E9=9D=A2=E5=AE=A2=E6=88=B7=E7=AB=AF=E4=BF=9D?=
 =?UTF-8?q?=E6=8C=81=E4=B8=80=E8=87=B4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../aiimage/modules/auth/service/JwtService.java  | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/JwtService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/JwtService.java
index e803a3dd..6d849529 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/JwtService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/JwtService.java
@@ -11,7 +11,6 @@ import org.springframework.stereotype.Service;
 
 import javax.crypto.SecretKey;
 import java.nio.charset.StandardCharsets;
-import java.security.SecureRandom;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Date;
@@ -22,7 +21,6 @@ import java.util.Date;
 public class JwtService {
 
     private static final String INSECURE_DEFAULT_SECRET = "please-change-this-secret-please-rotate-at-least-32-bytes";
-    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
 
     private final AuthProperties props;
 
@@ -35,14 +33,13 @@ public class JwtService {
                 key = cachedKey;
                 if (key == null) {
                     String configured = props.getJwtSecret();
-                    boolean insecure = configured == null || configured.isBlank()
-                            || INSECURE_DEFAULT_SECRET.equals(configured.trim());
                     byte[] keyBytes;
-                    if (insecure) {
-                        keyBytes = new byte[32];
-                        SECURE_RANDOM.nextBytes(keyBytes);
-                        log.warn("[auth] AIIMAGE_JWT_SECRET 未配置或仍为默认值，已自动生成随机密钥；"
-                                + "服务重启后已签发的 token 将失效，请通过环境变量 AIIMAGE_JWT_SECRET 配置固定密钥");
+                    if (configured == null || configured.isBlank()) {
+                        // 已分发到用户机器的桌面客户端内置同一个默认密钥，服务端必须保持一致，
+                        // 不能随机生成，否则所有旧客户端 /api/auth/sync 验签失败导致无法登录。
+                        keyBytes = INSECURE_DEFAULT_SECRET.getBytes(StandardCharsets.UTF_8);
+                        log.warn("[auth] AIIMAGE_JWT_SECRET 未配置，使用内置默认密钥；"
+                                + "生产环境请通过环境变量 AIIMAGE_JWT_SECRET 配置固定密钥（需与桌面客户端一致）");
                     } else {
                         keyBytes = configured.getBytes(StandardCharsets.UTF_8);
                     }