alibaba/nacos · error · AccessException

Token is required

Error message

Token is required

What it means

Thrown by OidcAuthenticationManager.authenticate(String) when the token argument is null, empty, or whitespace. It is the explicit pre-condition guard before token validation is attempted.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/OidcAuthenticationManager.java:68

    private final AuthorizationClient authorizationClient;
    
    public OidcAuthenticationManager(JwtTokenValidator tokenValidator,
        OidcUserMapper userMapper, AuthorizationClient authorizationClient) {
        this.tokenValidator = tokenValidator;
        this.userMapper = userMapper;
        this.authorizationClient = authorizationClient;
    }
    
    /**
     * Authenticate user by JWT token.
     *
     * @param token JWT token (Access Token or ID Token)
     * @return authenticated OidcUser
     * @throws AccessException if authentication fails
     */
    public OidcUser authenticate(String token) throws AccessException {
        if (StringUtils.isBlank(token)) {
            throw new AccessException("Token is required");
        }
        
        // Validate the token
        JWTClaimsSet claims = tokenValidator.validate(token);
        
        // Map claims to user
        OidcUser user = userMapper.mapToUser(claims);
        user.setToken(token);
        
        LOGGER.debug("User authenticated: {}", user.getUsername());
        return user;
    }
    
    /**
     * Authenticate user from identity context.
     *
     * @param identityContext identity context containing credentials
     * @return authenticated OidcUser

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Null/blank-check the token before calling authenticate(String).
2. Prefer authenticate(IdentityContext) which already tries Bearer header and accessToken param before delegating.
3. Ensure the upstream extraction layer returns a non-null token or short-circuits with a 401.

Example fix

// before
OidcUser user = manager.authenticate(tokenFromHeader); // tokenFromHeader may be null
// after
if (StringUtils.isBlank(tokenFromHeader)) {
    throw new AccessException("Missing Bearer token");
}
OidcUser user = manager.authenticate(tokenFromHeader);

// Guard the string overload before calling
if (StringUtils.isBlank(token)) {
    throw new AccessException("Missing OIDC token in request");
}
OidcUser user = manager.authenticate(token);

// Narrow a nullable token to a non-blank one before authenticating
String safeToken = (token != null && !token.trim().isEmpty()) ? token : null;
if (safeToken == null) {
    // handle missing token (401) instead of calling authenticate
}

try {
    manager.authenticate(token);
} catch (AccessException e) {
    if ("Token is required".equals(e.getMessage())) {
        // caller bug: passed null/blank token — do not surface to user, return 401
        respondUnauthorized();
    } else {
        throw e;
    }
}

When it happens

Trigger: A direct call to authenticate(token) with a null/blank token — e.g. a controller extracted no token from the request and forwarded the empty value.

Common situations: Caller extracted a header that was absent and passed null downstream; a code path that bypasses the IdentityContext-based authenticate(IdentityContext) and calls the string overload directly without a null check.

Related errors

• No valid OIDC token found
• Token endpoint not configured
• Token exchange failed:
• Failed to sign payload
• Client secret is required for state signing

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/dae330b42f5cf76d. Report an issue: GitHub.