alibaba/nacos · error · AccessException

Token processing error

Error message

Token processing error

What it means

Thrown from catch(JOSEException) when the JWT could be parsed but JOSE-level processing failed for a reason other than a bad signature (BadJOSEException) — e.g. the signing algorithm is not in the supported set, the key source cannot supply a key, or remote key retrieval throws a JOSEException.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java:115

            // Note: process(String) parses it.
            JWTClaimsSet claims = processor.process(token, null);
            
            // Additional validation
            validateClaims(claims);
            
            LOGGER.debug("Token validated successfully for subject: {}", claims.getSubject());
            return claims;
            
        } catch (ParseException e) {
            LOGGER.warn("Failed to parse JWT token: {}", e.getMessage());
            throw new AccessException("Invalid token format");
        } catch (BadJOSEException e) {
            LOGGER.warn("JWT signature verification failed: {}", e.getMessage());
            // Try refreshing JWKS and retry once (key rotation scenario)
            return retryWithRefreshedJwks(token, e);
        } catch (JOSEException e) {
            LOGGER.warn("JWT processing error: {}", e.getMessage());
            throw new AccessException("Token processing error");
        } catch (AccessException e) {
            throw e;
        } catch (IllegalArgumentException | NullPointerException e) {
            LOGGER.error("Invalid token data: {}", e.getMessage(), e);
            throw new AccessException("Invalid token format: " + e.getMessage());
        } catch (Exception e) {
            LOGGER.error("Unexpected error during token validation: {} - {}",
                e.getClass().getSimpleName(), e.getMessage(), e);
            throw new AccessException("Token validation failed: " + e.getClass().getSimpleName());
        }
    }
    
    private ConfigurableJWTProcessor<SecurityContext> getJwtProcessor() throws AccessException {
        if (jwtProcessor == null) {
            synchronized (this) {
                if (jwtProcessor == null) {
                    try {
                        jwtProcessor = createJwtProcessor(jwksProvider.getJwkSet());

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Check the token 'alg' header; if it is HS256 or 'none', reconfigure the IdP to use RS256/ES256/etc.
2. Confirm the token's 'kid' matches a key published in the IdP's JWKS endpoint.
3. Fetch the JWKS URI manually and verify it contains a key for the algorithm and kid used.
4. Inspect the log line 'JWT processing error: ...' for the exact JOSEException reason.
5. If a custom algorithm is required, extend SUPPORTED_ALGORITHMS in a forked plugin.

Example fix

// before: IdP configured to sign with HS256 (unsupported)
// Token header: {"alg":"HS256",...}

// after: reconfigure IdP client to use RS256
// Token header: {"alg":"RS256","kid":"...",...}

try {
    JWTClaimsSet claims = validator.validate(token);
} catch (AccessException e) {
    if ("Token processing error".equals(e.getMessage())) {
        // inspect prior WARN 'JWT processing error' for alg/key cause
    }
    throw e;
}

When it happens

Trigger: processor.process() raises JOSEException because the token's 'alg' header is not in SUPPORTED_ALGORITHMS (only RS/ES/PS 256/384/512 are accepted; HS256, none, or EdDSA are rejected), or the JWK key selector cannot resolve a key for the token's kid.

Common situations: IdP signs tokens with HS256 (symmetric) which the plugin does not support; key id (kid) in the token header has no matching key in the JWKS; JWKS endpoint returned keys but none match the algorithm; legacy IdP using an unsupported algorithm.

Related errors

• Token signature verification failed
• unsupported signature algorithm
• Invalid signature
• Token is empty
• Invalid token format

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/29fe382203468de9. Report an issue: GitHub.