- Shipped
- September 12, 2026 at 3:14 AM UTC
- Author
- Kamo
- Commit
- c3e65d9
JWTUtils decoded security-service.*** as Base64 only. The platform's secret is 64 hex digits (32 bytes), which Base64 turns into 48 meaningless bytes; those were then refused as too short for HS512. So every service that loads the bean logged "[JWT] Failed to initialize HMAC key" at startup and the utility could neither sign nor verify. The secret is now read in the form it is written in (hex, then Base64, then text), and material shorter than HS512's 64 bytes is stretched with SHA-512. Nothing could ever sign with the old behaviour, so no existing token changes.