{"record":{"id":"01bfb18b570eb805","repo":"alibaba/nacos","slug":"required-config-missing-token-secret-key","errorCode":null,"errorMessage":"Required config missing: token.secret.key","messagePattern":"Required config missing: token\\.secret\\.key","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/configuration/NacosAuthPluginConfig.java","lineNumber":95,"sourceCode":"    public static NacosAuthPluginConfig defaults() {\n        return new NacosAuthPluginConfig(AuthConstants.DEFAULT_TOKEN_SECRET_KEY,\n            AuthConstants.DEFAULT_TOKEN_EXPIRE_SECONDS, DEFAULT_TOKEN_CACHE_ENABLE,\n            DEFAULT_CACHING_ENABLED, DEFAULT_ANONYMOUS_AI_ENABLED);\n    }\n    \n    /**\n     * Parse and validate one effective plugin configuration map.\n     *\n     * @param config effective configuration\n     * @param tokenSecretRequired whether current module configuration requires token support\n     * @return parsed immutable configuration\n     */\n    public static NacosAuthPluginConfig from(Map<String, String> config,\n        boolean tokenSecretRequired) {\n        String tokenSecretKey = value(config, TOKEN_SECRET_KEY,\n            AuthConstants.DEFAULT_TOKEN_SECRET_KEY);\n        if (tokenSecretRequired && StringUtils.isBlank(tokenSecretKey)) {\n            throw new IllegalArgumentException(\"Required config missing: \" + TOKEN_SECRET_KEY);\n        }\n        validateTokenSecret(tokenSecretKey);\n        long tokenExpireSeconds = parsePositiveLong(value(config, TOKEN_EXPIRE_SECONDS,\n            AuthConstants.DEFAULT_TOKEN_EXPIRE_SECONDS.toString()), TOKEN_EXPIRE_SECONDS);\n        boolean tokenCacheEnabled = parseBoolean(value(config, TOKEN_CACHE_ENABLE,\n            Boolean.toString(DEFAULT_TOKEN_CACHE_ENABLE)), TOKEN_CACHE_ENABLE);\n        boolean cachingEnabled = parseBoolean(value(config, CACHING_ENABLED,\n            Boolean.toString(DEFAULT_CACHING_ENABLED)), CACHING_ENABLED);\n        boolean anonymousAiEnabled = parseBoolean(value(config, ANONYMOUS_AI_ENABLED,\n            Boolean.toString(DEFAULT_ANONYMOUS_AI_ENABLED)), ANONYMOUS_AI_ENABLED);\n        return new NacosAuthPluginConfig(tokenSecretKey, tokenExpireSeconds, tokenCacheEnabled,\n            cachingEnabled, anonymousAiEnabled);\n    }\n    \n    private static String value(Map<String, String> config, String key, String defaultValue) {\n        if (config == null || !config.containsKey(key)) {\n            return defaultValue;\n        }","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/configuration/NacosAuthPluginConfig.java#L77-L113","documentation":"Thrown by NacosAuthPluginConfig.from() when token authentication is required (any auth plugin enabled via NacosAuthConfigHolder.isAnyAuthEnabled()) but the 'token.secret.key' configuration resolves to a blank value. The default for token.secret.key is an empty string (AuthConstants.DEFAULT_TOKEN_SECRET_KEY = \"\"), so merely enabling auth without explicitly setting a secret key triggers this. It is an IllegalArgumentException raised during applyConfig at server startup or config reload.","triggerScenarios":"Server boots with nacos.core.auth.enabled=true (or any auth plugin enabled) but nacos.core.auth.plugin.nacos.token.secret.key is unset/blank. NacosAuthPluginService.applyConfig() calls NacosAuthPluginConfig.from(effectiveConfig, true); the value() helper returns the empty-string default, StringUtils.isBlank passes, and the throw fires.","commonSituations":"Enabling Nacos auth for the first time after an upgrade without generating a secret key; setting nacos.core.auth.enabled=true in application.properties but forgetting the token.secret.key property; copying a config file that has the key commented out.","solutions":["Generate a base64 secret key of at least 32 bytes: openssl rand -base64 32 (or 64 for HS512).","Set nacos.core.auth.plugin.nacos.token.secret.key=<generated-key> in the server's custom.properties / application.properties (or via the console plugin-config UI).","Restart (or re-apply config through the console) so applyConfig() re-parses with a non-blank key."],"exampleFix":"// before (application.properties)\nnacos.core.auth.enabled=true\n# token.secret.key missing -> error 1260 at boot\n\n// after\nnacos.core.auth.enabled=true\nnacos.core.auth.plugin.nacos.token.secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789","handlingStrategy":"validation","validationCode":"// Before enabling auth / applying config, ensure a non-blank secret key is present.\nString key = effectiveConfig.get(NacosAuthPluginConfig.TOKEN_SECRET_KEY);\nboolean authEnabled = NacosAuthConfigHolder.getInstance().isAnyAuthEnabled();\nif (authEnabled && StringUtils.isBlank(key)) {\n    throw new IllegalStateException(\n        \"Refusing to apply config: token.secret.key is blank while auth is enabled. \"\n        + \"Generate one with: openssl rand -base64 64\");\n}\nNacosAuthPluginConfig.from(effectiveConfig, authEnabled);","typeGuard":null,"tryCatchPattern":"try {\n    NacosAuthPluginConfig.from(effectiveConfig, authEnabled);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"token.secret.key\")) {\n        log.error(\"Auth enabled but token.secret.key missing/blank; boot will fail until set\");\n    }\n    throw e;\n}","preventionTips":["Add a startup preflight check that fails fast with a clear message when auth is enabled but token.secret.key is blank.","Document the openssl rand -base64 64 generation step next to the auth.enable property.","Store the secret key in a secret manager / env var rather than committing it to the repo."],"tags":["auth","config","startup","security","token"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}