{"record":{"id":"0da9db60f2af89cf","repo":"alibaba/nacos","slug":"invalid-token-format","errorCode":null,"errorMessage":"Invalid token format","messagePattern":"Invalid token format","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":108,"sourceCode":"        }\n        \n        try {\n            // Ensure processor is initialized (lazy init)\n            ConfigurableJWTProcessor<SecurityContext> processor = getJwtProcessor();\n            \n            // Process and validate the token (Parsing also happens inside process but we parse handled inside)\n            // Note: process(String) parses it.\n            JWTClaimsSet claims = processor.process(token, null);\n            \n            // Additional validation\n            validateClaims(claims);\n            \n            LOGGER.debug(\"Token validated successfully for subject: {}\", claims.getSubject());\n            return claims;\n            \n        } catch (ParseException e) {\n            LOGGER.warn(\"Failed to parse JWT token: {}\", e.getMessage());\n            throw new AccessException(\"Invalid token format\");\n        } catch (BadJOSEException e) {\n            LOGGER.warn(\"JWT signature verification failed: {}\", e.getMessage());\n            // Try refreshing JWKS and retry once (key rotation scenario)\n            return retryWithRefreshedJwks(token, e);\n        } catch (JOSEException e) {\n            LOGGER.warn(\"JWT processing error: {}\", e.getMessage());\n            throw new AccessException(\"Token processing error\");\n        } catch (AccessException e) {\n            throw e;\n        } catch (IllegalArgumentException | NullPointerException e) {\n            LOGGER.error(\"Invalid token data: {}\", e.getMessage(), e);\n            throw new AccessException(\"Invalid token format: \" + e.getMessage());\n        } catch (Exception e) {\n            LOGGER.error(\"Unexpected error during token validation: {} - {}\",\n                e.getClass().getSimpleName(), e.getMessage(), e);\n            throw new AccessException(\"Token validation failed: \" + e.getClass().getSimpleName());\n        }\n    }","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L90-L126","documentation":"Thrown from the catch(ParseException) branch when the NimbusDS JWT parser cannot parse the token string into a structured JWT. It means the string is present but is not a syntactically valid JWT (three base64URL segments separated by dots).","triggerScenarios":"processor.process(token) raises ParseException because the token is not a JWT: an opaque token, a truncated token, a base64-malformed payload, or a non-JSON claims segment.","commonSituations":"Client sent an opaque/session reference token while the plugin is configured for token-validation-method=jwt; the token was URL-decoded incorrectly and corrupted; copy/paste truncated the token; the IdP was pointed at the wrong token endpoint returning HTML/error text.","solutions":["Confirm the token is actually a JWT (decodes at jwt.io, has three dot-separated segments).","Check the plugin config token-validation-method matches the token type the IdP issues (jwt vs introspection).","If the IdP issues opaque tokens, switch token-validation-method to 'introspection'.","Inspect server logs for 'Failed to parse JWT token: ...' which carries the parser's reason.","Verify the token is not being double-encoded or whitespace-trimmed incorrectly in transit."],"exampleFix":"# before (IdP issues opaque tokens, plugin expects JWT)\nnacos.plugin.auth.oidc.token-validation-method=jwt\n\n# after\nnacos.plugin.auth.oidc.token-validation-method=introspection","handlingStrategy":"validation","validationCode":"boolean looksLikeJwt(String t) {\n    return t != null && t.split(\"\\\\.\").length == 3;\n}\nif (!looksLikeJwt(token)) {\n    throw new AccessException(\"Token is not a JWT\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    JWTClaimsSet claims = validator.validate(token);\n} catch (AccessException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Invalid token format\")) {\n        // 401 malformed/unsupported token; advise client to use a JWT\n    }\n    throw e;\n}","preventionTips":["Align token-validation-method (jwt vs introspection) with what the IdP actually issues.","Validate the token has three dot-separated segments before submission.","Log the parser reason (the WARN line) to distinguish truncation from wrong token type."],"tags":["oidc","jwt","parsing","token-format"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}