alibaba/nacos · error · AccessException

Token signature verification failed

Error message

Token signature verification failed

What it means

Thrown at the end of retryWithRefreshedJwks after a BadJOSEException triggered a one-shot JWKS refresh and the retry still failed. It signals that the token's signature does not verify against any current key from the IdP.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java:192

        try {
            // Refresh JWKS
            JWKSet jwkSet = jwksProvider.refreshJwkSet();
            
            // Recreate processor with new keys
            synchronized (this) {
                this.jwtProcessor = createJwtProcessor(jwkSet);
            }
            
            // Validate using new processor
            JWTClaimsSet claims = this.jwtProcessor.process(token, null);
            validateClaims(claims);
            
            LOGGER.info("Token validated successfully after JWKS refresh");
            return claims;
            
        } catch (Exception e) {
            LOGGER.warn("Token validation failed even after JWKS refresh: {}", e.getMessage());
            throw new AccessException("Token signature verification failed");
        }
    }
    
    /**
     * Perform additional claims validation.
     *
     * @param claims JWT claims
     * @throws AccessException if validation fails
     */
    private void validateClaims(JWTClaimsSet claims) throws AccessException {
        // Validate expiration
        Date expirationTime = claims.getExpirationTime();
        if (expirationTime == null || expirationTime.before(new Date())) {
            throw new AccessException("Token has expired");
        }
        
        // Validate not before (if present)
        Date notBeforeTime = claims.getNotBeforeTime();

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Have the client obtain a fresh token from the correct IdP and retry.
2. Confirm the token's issuer matches the configured issuer-uri (cross-environment token reuse is a common cause).
3. Verify the IdP JWKS still contains the key matching the token's kid.
4. Inspect the preceding WARN log 'Token validation failed even after JWKS refresh: ...' for the underlying cause.
5. If the issue persists, check whether the token validation method should be 'introspection' instead of 'jwt'.

try {
    validator.validate(token);
} catch (AccessException e) {
    if ("Token signature verification failed".equals(e.getMessage())) {
        // ask client to obtain a fresh token from the correct IdP
    }
    throw e;
}

When it happens

Trigger: Initial signature verification failed (BadJOSEException), the validator refreshed the JWKS from the IdP, recreated the processor, re-ran process()/validateClaims(), and that also threw. The generic catch(Exception) collapses any retry failure into this message.

Common situations: Token was minted by a different/stale IdP or environment; key rotation is complete but the client holds a token signed by a retired key; token was tampered with; the token's kid references a key never published in JWKS; clock/claims issue surfaced on retry.

Related errors

• Token processing error
• Failed to initialize JWT processor:
• Invalid signature
• JWKS URI is not configured or discovered
• Failed to fetch JWKS, status:

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/a75afa7073a30dd8. Report an issue: GitHub.