{"record":{"id":"29fe382203468de9","repo":"alibaba/nacos","slug":"token-processing-error","errorCode":null,"errorMessage":"Token processing error","messagePattern":"Token processing error","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":115,"sourceCode":"            // Note: process(String) parses it.\n            JWTClaimsSet claims = processor.process(token, null);\n            \n            // Additional validation\n            validateClaims(claims);\n            \n            LOGGER.debug(\"Token validated successfully for subject: {}\", claims.getSubject());\n            return claims;\n            \n        } catch (ParseException e) {\n            LOGGER.warn(\"Failed to parse JWT token: {}\", e.getMessage());\n            throw new AccessException(\"Invalid token format\");\n        } catch (BadJOSEException e) {\n            LOGGER.warn(\"JWT signature verification failed: {}\", e.getMessage());\n            // Try refreshing JWKS and retry once (key rotation scenario)\n            return retryWithRefreshedJwks(token, e);\n        } catch (JOSEException e) {\n            LOGGER.warn(\"JWT processing error: {}\", e.getMessage());\n            throw new AccessException(\"Token processing error\");\n        } catch (AccessException e) {\n            throw e;\n        } catch (IllegalArgumentException | NullPointerException e) {\n            LOGGER.error(\"Invalid token data: {}\", e.getMessage(), e);\n            throw new AccessException(\"Invalid token format: \" + e.getMessage());\n        } catch (Exception e) {\n            LOGGER.error(\"Unexpected error during token validation: {} - {}\",\n                e.getClass().getSimpleName(), e.getMessage(), e);\n            throw new AccessException(\"Token validation failed: \" + e.getClass().getSimpleName());\n        }\n    }\n    \n    private ConfigurableJWTProcessor<SecurityContext> getJwtProcessor() throws AccessException {\n        if (jwtProcessor == null) {\n            synchronized (this) {\n                if (jwtProcessor == null) {\n                    try {\n                        jwtProcessor = createJwtProcessor(jwksProvider.getJwkSet());","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L97-L133","documentation":"Thrown from catch(JOSEException) when the JWT could be parsed but JOSE-level processing failed for a reason other than a bad signature (BadJOSEException) — e.g. the signing algorithm is not in the supported set, the key source cannot supply a key, or remote key retrieval throws a JOSEException.","triggerScenarios":"processor.process() raises JOSEException because the token's 'alg' header is not in SUPPORTED_ALGORITHMS (only RS/ES/PS 256/384/512 are accepted; HS256, none, or EdDSA are rejected), or the JWK key selector cannot resolve a key for the token's kid.","commonSituations":"IdP signs tokens with HS256 (symmetric) which the plugin does not support; key id (kid) in the token header has no matching key in the JWKS; JWKS endpoint returned keys but none match the algorithm; legacy IdP using an unsupported algorithm.","solutions":["Check the token 'alg' header; if it is HS256 or 'none', reconfigure the IdP to use RS256/ES256/etc.","Confirm the token's 'kid' matches a key published in the IdP's JWKS endpoint.","Fetch the JWKS URI manually and verify it contains a key for the algorithm and kid used.","Inspect the log line 'JWT processing error: ...' for the exact JOSEException reason.","If a custom algorithm is required, extend SUPPORTED_ALGORITHMS in a forked plugin."],"exampleFix":"// before: IdP configured to sign with HS256 (unsupported)\n// Token header: {\"alg\":\"HS256\",...}\n\n// after: reconfigure IdP client to use RS256\n// Token header: {\"alg\":\"RS256\",\"kid\":\"...\",...}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    JWTClaimsSet claims = validator.validate(token);\n} catch (AccessException e) {\n    if (\"Token processing error\".equals(e.getMessage())) {\n        // inspect prior WARN 'JWT processing error' for alg/key cause\n    }\n    throw e;\n}","preventionTips":["Ensure the IdP signs with RS/ES/PS 256/384/512 only.","Confirm the token kid exists in the JWKS before relying on the token.","Periodically fetch and inspect the JWKS to detect key/algorithm drift."],"tags":["oidc","jwt","jose","algorithm","signature"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}