alibaba/nacos · error · NacosException

SERVER_ERROR

SERVER_ERROR

Error message

{unexpectedExceptionMessage}

What it means

Thrown by RemoteVisibilityGrantService.grant() when the remote HTTP POST to grant visibility fails with an exception that is NOT a NacosException — e.g. network IOException, connection timeout, SSL error, or form-encoding failure. Unlike NacosUserServiceRemoteImpl, this class re-throws NacosException as-is (not wrapping in NacosRuntimeException), and only wraps non-Nacos exceptions as NacosException with SERVER_ERROR code. Used in standalone console deployments that forward requests to a remote server.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/visibility/RemoteVisibilityGrantService.java:78

    }
    
    @Override
    public void grant(String namespaceId, String resourceType, String resourceName, String username,
        String action) throws NacosException {
        Map<String, String> body = new LinkedHashMap<>(4);
        body.put("resourceType", resourceType);
        body.put("resourceName", resourceName);
        body.put("username", username);
        body.put("action", action);
        try {
            HttpRestResult<String> result = nacosRestTemplate.postForm(buildRemoteUrl(),
                buildForwardedIdentityHeader(), buildForwardedAccessTokenQuery(namespaceId), body,
                String.class);
            RemoteServerUtil.singleCheckResult(result);
        } catch (NacosException e) {
            throw e;
        } catch (Exception unexpectedException) {
            throw new NacosException(NacosException.SERVER_ERROR,
                unexpectedException.getMessage());
        }
    }
    
    @Override
    public void revoke(String namespaceId, String resourceType, String resourceName,
        String username, String action) throws NacosException {
        Query query = buildForwardedAccessTokenQuery(namespaceId).addParam("resourceType",
            resourceType).addParam("resourceName", resourceName).addParam("username", username)
            .addParam("action", action);
        try {
            HttpRestResult<String> result = nacosRestTemplate.delete(buildRemoteUrl(),
                buildForwardedIdentityHeader(), query, String.class);
            RemoteServerUtil.singleCheckResult(result);
        } catch (NacosException e) {
            throw e;
        } catch (Exception unexpectedException) {
            throw new NacosException(NacosException.SERVER_ERROR,

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Verify network connectivity from the console node to all server addresses in cluster.conf.
2. Check the exception message (in NacosException.getErrMsg()) for transport-specific error keywords.
3. Ensure the buildRemoteUrl() resolves to a valid, reachable endpoint.
4. Verify that buildForwardedIdentityHeader() and buildForwardedAccessTokenQuery() correctly capture and forward the caller's credentials.

Example fix

// No code fix — runtime/network error. Diagnose via:
// curl -X POST http://<server>/nacos/v3/auth/visibility \
//   -H "Authorization: Bearer <token>" \
//   -d "resourceType=config&resourceName=app.yml&username=alice&action=r"

// Verify connectivity before the grant call
String serverAddr = RemoteServerUtil.getOneNacosServerAddress();
if (serverAddr == null) {
    throw new NacosException(NacosException.SERVER_ERROR,
        "No remote server address available");
}

try {
    visibilityService.grant(namespaceId, resourceType, resourceName, username, action);
} catch (NacosException e) {
    if (e.getErrCode() == NacosException.SERVER_ERROR) {
        // transport-level failure — check network and server identity config
        log.error("Visibility grant remote call failed: {}", e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Calling grant() on RemoteVisibilityGrantService when the remote server is unreachable, the connection times out, or the HTTP client encounters a transport-level error during the POST to the visibility API endpoint.

Common situations: Network partition between the standalone console and the Nacos server; cluster.conf points to an unreachable address; SSL/TLS misconfiguration; the forwarded identity header or access token is missing causing a non-Nacos-level rejection.

Related errors

• 500
• HTTP error! status: ${response.status}
• HTTP error! status: ${response.status}
• HTTP error! status: ${response.status}
• e.getErrMsg()

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/56372c1fe3ba66fe. Report an issue: GitHub.