alibaba/nacos · error · AccessException

user not found!

Error message

user not found!

What it means

Thrown by NacosSignatureAlgorithm.verify(jwt, key) as a com.alibaba.nacos.plugin.auth.exception.AccessException when the supplied JWT string is blank (null, empty, or whitespace). The method treats a missing token as 'no user present'. This is the first guard before any JWT parsing.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java:99

    private final String header;
    
    static {
        MAP.put(HS256_JWT_HEADER, HS256);
        MAP.put(HS384_JWT_HEADER, HS384);
        MAP.put(HS512_JWT_HEADER, HS512);
    }
    
    /**
     * verify jwt.
     *
     * @param jwt complete jwt string
     * @param key for signature
     * @return object for payload
     * @throws AccessException access exception
     */
    public static NacosUser verify(String jwt, Key key) throws AccessException {
        if (StringUtils.isBlank(jwt)) {
            throw new AccessException("user not found!");
        }
        String[] split = jwt.split("\\.");
        if (split.length != JWT_PARTS) {
            throw new AccessException("token invalid!");
        }
        String header = split[HEADER_POSITION];
        String payload = split[PAYLOAD_POSITION];
        String signature = split[SIGNATURE_POSITION];
        
        NacosSignatureAlgorithm signatureAlgorithm = MAP.get(header);
        if (signatureAlgorithm == null) {
            throw new AccessException("unsupported signature algorithm");
        }
        NacosUser user = signatureAlgorithm.verify(header, payload, signature, key);
        user.setToken(jwt);
        return user;
    }
    

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure the caller sends a non-empty Bearer token in the Authorization header.
2. Validate StringUtils.isBlank(jwt) before calling verify() and return a clear 401.
3. Check the token-extraction code path (header/cookie name) against the actual request.

Example fix

// before
String token = request.getHeader("Auth"); // wrong header -> null
NacosUser user = NacosSignatureAlgorithm.verify(token, key);

// after
String token = request.getHeader("Authorization");
token = token != null && token.startsWith("Bearer ") ? token.substring(7) : null;
if (StringUtils.isBlank(token)) throw new AccessException("user not found!");
NacosUser user = NacosSignatureAlgorithm.verify(token, key);

if (StringUtils.isBlank(jwt)) {
    throw new AccessException("user not found!"); // or return 401 to the client
}
NacosSignatureAlgorithm.verify(jwt, key);

try {
    NacosUser user = NacosSignatureAlgorithm.verify(jwt, key);
} catch (AccessException e) {
    if ("user not found!".equals(e.getMessage())) {
        // no token presented — respond 401 Unauthorized
    }
    throw e;
}

When it happens

Trigger: verify() is called with a null/empty jwt — e.g., the Authorization header was missing and downstream code passed the raw (blank) token value straight into verify().

Common situations: A client omits the Authorization header; a filter extracts a token from the wrong header name and gets null; an integration passes the cookie value before it is set.

Related errors

• the length of secret key must great than or equal 32 bytes;
• token invalid!
• token expired!
• Nacos auth plugin has not been initialized
• Token secret key change requires restart

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/c31d3a3db2f9ffd3. Report an issue: GitHub.