spring mvc - Authentication-Flows: java.lang.StringIndexOutOfBoundsException: String index out of range: -1 -

i'm refer project of ohadr, using spring security login , set new password email. link:

authentication-flows: https://github.com/ohadr/authentication-flows 

i have finished steps as:

1. create account 2. confirm account email 3. login sucess 4. change or set new password (this step happened exception) 

but when input new password , confirm new password, received exception following as:

severe: servlet.service() servlet [action] in context path [] threw exception [request processing failed; nested exception java.lang.stringindexoutofboundsexception: string index out of range: -1] root cause  java.lang.stringindexoutofboundsexception: string index out of range: -1 @ java.lang.string.substring(unknown source) @ com.ohadr.web.crypto.service.cryptoservice.getdecodedstringfromencodedbased64string(cryptoservice.java:244) @ com.ohadr.web.crypto.service.cryptoservice.extractstringanddate(cryptoservice.java:107) @ com.ohadr.web.auth_flows.core.authenticationflowsprocessorimpl.handlesetnewpassword(authenticationflowsprocessorimpl.java:279) @ com.ohadr.web.auth_flows.web.useractioncontroller.setnewpassword(useractioncontroller.java:239) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(unknown source) @ sun.reflect.delegatingmethodaccessorimpl.invoke(unknown source) @ java.lang.reflect.method.invoke(unknown source) @ org.springframework.web.method.support.invocablehandlermethod.doinvoke(invocablehandlermethod.java:222) @ org.springframework.web.method.support.invocablehandlermethod.invokeforrequest(invocablehandlermethod.java:137) @ org.springframework.web.servlet.mvc.method.annotation.servletinvocablehandlermethod.invokeandhandle(servletinvocablehandlermethod.java:110) @ org.springframework.web.servlet.mvc.method.annotation.requestmappinghandleradapter.invokehandlermethod(requestmappinghandleradapter.java:814) @ org.springframework.web.servlet.mvc.method.annotation.requestmappinghandleradapter.handleinternal(requestmappinghandleradapter.java:737) @ org.springframework.web.servlet.mvc.method.abstracthandlermethodadapter.handle(abstracthandlermethodadapter.java:85) 

this scope code cause exception:

@override public string handlesetnewpassword(          string encuserandtimestamp,         string password,         string retypedpassword) throws authenticationflowsexception {     validateretypedpassword(password, retypedpassword);      immutablepair<date, string> stringanddate =     cryptoservice.extractstringanddate( encuserandtimestamp );      validateexpiration(stringanddate.getleft());      string email = stringanddate.getright();      //after validations, make work: validate password constraints, , update db:      //validate input:     authenticationpolicy settings = getauthenticationsettings();      validatepassword(password, settings);        string encodedpassword = encodestring(email, password);      // go db and: (1) update password, , (2) activate account:     setpassword(email, encodedpassword);      return email; } 

set values debug: (updated)

(updated)

get , set value when debug: value of link in email:

http://localhost:9999/rp?uts=ap0wgvpl56fiybmshhle5yh5pwekz/kwebja32ujpsxw 

when click link, redirect url(set new password screen):

http://localhost:9999/login/setnewpassword.jsp?enc=ap0wgvpl56fiybmshhle5yh5pwekz/kwebja32ujpsxw 

and input value in encuserandtimestamp parameter in debug

finally, received message error:

failed decrypt url content http://localhost:9999/login/setnewpassword.jsp?enc=ap0wgvpl56fiybmshhle5yh5pwekz/kwebja32ujpsxw 

it seem url wrong !!

how fix exception, thank much!

you right; indeed bug (since 2014...)

https://github.com/ohadr/authentication-flows/issues/13

however though, i've try reproduce (forgot-password flow), , works fine! here link youtube, can see did...