{"record":{"id":"2848c95f8d44dfe2","repo":"halo-dev/halo","slug":"cookie-token-1-has-expired-expired-on-curr","errorCode":null,"errorMessage":"Cookie token[1] has expired (expired on '{}'; current time is '{}')","messagePattern":"Cookie token\\[1\\] has expired \\(expired on '(.+?)'; current time is '(.+?)'\\)","errorType":"validation","errorClass":"InvalidCookieException","httpStatus":null,"severity":"error","filePath":"application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java","lineNumber":145,"sourceCode":"        } else if (ex instanceof RememberMeAuthenticationException) {\n            log.debug(ex.getMessage());\n        }\n        return Mono.empty();\n    }\n\n    protected void cancelCookie(ServerWebExchange exchange) {\n        rememberMeCookieResolver.expireCookie(exchange);\n    }\n\n    protected Mono<UserDetails> processAutoLoginCookie(String[] cookieTokens, ServerWebExchange exchange) {\n        if (!isValidCookieTokensLength(cookieTokens)) {\n            throw new InvalidCookieException(\n                    \"Cookie token did not contain 3 or 4 tokens, but contained '\" + Arrays.asList(cookieTokens) + \"'\");\n        }\n\n        long tokenExpiryTime = getTokenExpiryTime(cookieTokens);\n        if (isTokenExpired(tokenExpiryTime)) {\n            throw new InvalidCookieException(\"Cookie token[1] has expired (expired on '\" + new Date(tokenExpiryTime)\n                    + \"'; current time is '\" + new Date() + \"')\");\n        }\n\n        // Check the user exists. Defer lookup until after expiry time checked, to\n        // possibly avoid expensive database call.\n        return getUserDetailsService()\n                .findByUsername(cookieTokens[0])\n                .switchIfEmpty(Mono.error(new UsernameNotFoundException(\"User '\" + cookieTokens[0] + \"' not found\")))\n                .flatMap(userDetails -> {\n                    // Check signature of token matches remaining details. Must do this after user\n                    // lookup, as we need the DAO-derived password. If efficiency was a major issue,\n                    // just add in a UserCache implementation, but recall that this method is usually\n                    // only called once per HttpSession - if the token is valid, it will cause\n                    // SecurityContextHolder population, whilst if invalid, will cause the cookie to\n                    // be cancelled.\n                    String actualTokenSignature;\n                    String actualAlgorithm = DEFAULT_ALGORITHM;\n                    // If the cookie value contains the algorithm, we use that algorithm to check the","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/halo-dev/halo/blob/d2f5165f9c8f055ffcb3fa9c3f4032821a7b68c8/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java#L127-L163","documentation":"Error \"Cookie token[1] has expired (expired on '{}'; current time is '{}')\" thrown in halo-dev/halo.","triggerScenarios":"Thrown at application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java:145 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Log in again; the remember-me token has passed its expiry time.","If tokens expire too quickly, increase the remember-me token validity in the security configuration.","Check the server clock for drift, since expiry is compared against the server's current time."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d2f5165f9c8f055ffcb3fa9c3f4032821a7b68c8","analyzedAt":"2026-08-14T00:18:38.915Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}