alibaba/nacos · error · AccessException

Nonce not present in ID token. Set 'nacos.plugin.auth.oidc.s

Error message

Nonce not present in ID token. Set 'nacos.plugin.auth.oidc.strict-nonce-validation=false' if your IdP doesn't support nonce.

What it means

Thrown by AuthorizationCodeHandler.exchangeCodeForUser when the validated ID token contains no 'nonce' claim and strict nonce validation is enabled (config.isStrictNonceValidation() == true). The nonce claim is expected to match the nonce embedded in the signed state to prevent token replay. With strict mode on, a missing nonce is treated as a hard failure. The message tells the operator how to relax the check.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java:178

                throw new AccessException("Invalid or expired state parameter");
            }
            
            // Exchange code for tokens
            OIDCTokens tokens = exchangeCodeForTokens(code, redirectUri);
            
            // Validate ID token
            String idTokenString = tokens.getIDTokenString();
            JWTClaimsSet claims = tokenValidator.validate(idTokenString);
            
            // Verify nonce matches (protects against token replay attacks)
            String tokenNonce = (String) claims.getClaim("nonce");
            
            if (tokenNonce == null) {
                String message = "Nonce not present in ID token";
                if (config.isStrictNonceValidation()) {
                    LOGGER.error("{} - Strict validation enabled, rejecting authentication",
                        message);
                    throw new AccessException(message
                        + ". Set 'nacos.plugin.auth.oidc.strict-nonce-validation=false' "
                        + "if your IdP doesn't support nonce.");
                } else {
                    LOGGER.warn("{} - Strict validation disabled, allowing authentication. "
                        + "This reduces protection against replay attacks.", message);
                }
            } else if (!stateData.nonce.equals(tokenNonce)) {
                String message = String.format("Nonce mismatch: expected %s, got %s",
                    stateData.nonce, tokenNonce);
                LOGGER.error("{} - Possible token replay attack detected", message);
                throw new AccessException(message);
            }
            
            // Map claims to user
            OidcUser user = userMapper.mapToUser(claims);
            user.setToken(tokens.getAccessToken().getValue());
            
            LOGGER.info("User authenticated via authorization code: {}", user.getUsername());

View on GitHub (pinned to 9b989acdf1)

Solutions

  1. If your IdP legitimately does not support nonce, set nacos.plugin.auth.oidc.strict-nonce-validation=false to allow login without nonce (at the cost of weaker replay protection).
  2. Prefer configuring the IdP to include the nonce claim in the ID token if it supports it.
  3. Verify the authorization request actually sent a nonce (the handler does send one) and that the IdP echoes it.

Example fix

# before: strict nonce validation rejects IdP without nonce support
nacos.plugin.auth.oidc.strict-nonce-validation=true

# after: relax for IdPs that don't echo nonce (weigh replay risk)
nacos.plugin.auth.oidc.strict-nonce-validation=false
Defensive patterns

Strategy: try-catch

Try / catch

try {
    OidcUser user = handler.exchangeCodeForUser(code, state, redirectUri);
} catch (AccessException e) {
    if (e.getMessage().contains("Nonce not present")) {
        // either enable nonce on IdP or set strict-nonce-validation=false
    }
}

Prevention

When it happens

Trigger: The IdP returns a valid ID token that omits the nonce claim (some IdPs or custom claim mappings do not echo nonce), and nacos.plugin.auth.oidc.strict-nonce-validation is true (the default). The handler logs an ERROR and throws AccessException with the remediation hint.

Common situations: The IdP does not support the OIDC nonce parameter; a custom claim mapper strips nonce; the IdP was recently changed or its nonce support differs from expectations.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/00def0331c73fe09. Report an issue: GitHub.