alibaba/nacos · warning · AccessException

Token is empty

Error message

Token is empty

What it means

Thrown by JwtTokenValidator.validate() when the token argument is null, empty, or whitespace. The validator refuses to process a missing credential before doing any signature or claims work, so this is a client-side precondition failure rather than a crypto failure.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java:89

        JWSAlgorithm.RS256, JWSAlgorithm.RS384, JWSAlgorithm.RS512,
        JWSAlgorithm.ES256, JWSAlgorithm.ES384, JWSAlgorithm.ES512,
        JWSAlgorithm.PS256, JWSAlgorithm.PS384, JWSAlgorithm.PS512));
    
    public JwtTokenValidator(OidcAuthPluginConfig config, JwksProvider jwksProvider) {
        this.config = config;
        this.jwksProvider = jwksProvider;
    }
    
    /**
     * Validate a JWT token and return the claims.
     *
     * @param token JWT token string
     * @return validated JWT claims
     * @throws AccessException if validation fails
     */
    public JWTClaimsSet validate(String token) throws AccessException {
        if (StringUtils.isBlank(token)) {
            throw new AccessException("Token is empty");
        }
        
        try {
            // Ensure processor is initialized (lazy init)
            ConfigurableJWTProcessor<SecurityContext> processor = getJwtProcessor();
            
            // Process and validate the token (Parsing also happens inside process but we parse handled inside)
            // Note: process(String) parses it.
            JWTClaimsSet claims = processor.process(token, null);
            
            // Additional validation
            validateClaims(claims);
            
            LOGGER.debug("Token validated successfully for subject: {}", claims.getSubject());
            return claims;
            
        } catch (ParseException e) {
            LOGGER.warn("Failed to parse JWT token: {}", e.getMessage());

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure the client sends 'Authorization: Bearer <jwt>' on every protected request.
2. Confirm the token flow completed (OIDC authorization code / token exchange returned an access_token) before calling protected APIs.
3. Check that no proxy/load balancer strips the Authorization header.
4. If writing plugin code that calls validate() directly, guard the token source and surface a clear 401 instead of passing null.
5. Verify the token is being read from the correct request attribute/cookie if a gateway injects it.

Example fix

// before
String token = request.getHeader("Authorization"); // "Bearer " with nothing after
validator.validate(token);

// after
String raw = request.getHeader("Authorization");
String token = (raw != null && raw.startsWith("Bearer ")) ? raw.substring(7).trim() : null;
if (StringUtils.isBlank(token)) {
    throw new AccessException("Missing Bearer token");
}
validator.validate(token);

import org.apache.commons.lang3.StringUtils;

String raw = request.getHeader("Authorization");
String token = (raw != null && raw.startsWith("Bearer ")) ? raw.substring(7).trim() : null;
if (StringUtils.isBlank(token)) {
    // return 401 instead of calling validate()
    throw new AccessException("Missing Bearer token");
}

try {
    JWTClaimsSet claims = validator.validate(token);
} catch (AccessException e) {
    if ("Token is empty".equals(e.getMessage())) {
        // 401 missing credential
    }
    throw e;
}

When it happens

Trigger: An API call reaches the OIDC auth plugin with no Bearer token: a missing or empty Authorization header, a header that contains only 'Bearer ' with no value, or code passing null/"" into JwtTokenValidator.validate(String).

Common situations: Frontend forgets to attach the access token after OIDC login; a reverse proxy strips the Authorization header; the client obtained an opaque/session cookie but sent it where a JWT is expected; integration tests call a protected endpoint without authenticating first.

Related errors

• the length of secret key must great than or equal 32 bytes;
• user not found!
• token invalid!
• token expired!
• Nacos auth plugin has not been initialized

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/4d815d7f91e03932. Report an issue: GitHub.