{"record":{"id":"40556d897df35cce","repo":"alibaba/nacos","slug":"403","errorCode":"403","errorMessage":"Code: %d, Message: %s.","messagePattern":"Code: (.+?), Message: (.+?)\\.","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/com/alibaba/nacos/core/auth/RemoteRequestAuthFilter.java","lineNumber":116,"sourceCode":"                        return defaultResponseInstance;\n                    case MATCHED:\n                        return null;\n                    default:\n                        break;\n                }\n                if (!protocolAuthService.enableAuth(secured)) {\n                    return null;\n                }\n                String clientIp = meta.getClientIp();\n                request.putHeader(Constants.Identity.X_REAL_IP, clientIp);\n                Resource resource = protocolAuthService.parseResource(request, secured);\n                IdentityContext identityContext = protocolAuthService.parseIdentity(request);\n                AuthResult result = protocolAuthService.validateIdentity(identityContext, resource);\n                requestContext.getAuthContext().setIdentityContext(identityContext);\n                requestContext.getAuthContext().setResource(resource);\n                requestContext.getAuthContext().setAuthResult(result);\n                if (!result.isSuccess()) {\n                    throw new AccessException(result.format());\n                }\n                String action = secured.action().toString();\n                result = protocolAuthService.validateAuthority(identityContext,\n                    new Permission(resource, action));\n                if (!result.isSuccess()) {\n                    throw new AccessException(result.format());\n                }\n            }\n        } catch (AccessException e) {\n            if (Loggers.AUTH.isDebugEnabled()) {\n                Loggers.AUTH.debug(\"access denied, request: {}, reason: {}\",\n                    request.getClass().getSimpleName(),\n                    e.getErrMsg());\n            }\n            Response defaultResponseInstance = getDefaultResponseInstance(handlerClazz);\n            defaultResponseInstance.setErrorInfo(NacosException.NO_RIGHT, e.getErrMsg());\n            return defaultResponseInstance;\n        } catch (Exception e) {","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/core/src/main/java/com/alibaba/nacos/core/auth/RemoteRequestAuthFilter.java#L98-L134","documentation":"Thrown by RemoteRequestAuthFilter (gRPC/internal-request auth filter) at the identity-validation stage (line 116). After parsing the identity from the request, protocolAuthService.validateIdentity(...) is called; if the identity cannot be authenticated (bad/missing/expired token, no credentials), AuthResult.isSuccess() is false and an AccessException with result.format() is thrown. This is an authentication denial on a remote (gRPC) request. The filter catches AccessException and returns a 403 (NO_RIGHT) response.","triggerScenarios":"A gRPC/remote request to a @Secured handler with no AccessToken header, an expired token, an invalid token signature, or credentials that fail identity validation. Distinct from 1039 (authority): this is 'who are you?' failing, not 'are you allowed?'. E.g. a client SDK with no auth config connecting to an auth-enabled server.","commonSituations":"Client SDK not configured with username/password or access token. Token expired. Server identity header mismatch when using server-identity auth. Username/password changed server-side but client caches old creds. gRPC client connecting without the auth interceptor.","solutions":["Provide valid credentials: set username/password or AccessToken in the client SDK config.","If using server-identity auth, ensure the identity key/value headers match the server config.","Refresh expired tokens.","Verify the auth plugin type matches between client and server."],"exampleFix":"// before (Java client, no auth)\nNamingService naming = NamingFactory.createNamingService(\"127.0.0.1:8848\");\n\n// after (with credentials)\nProperties props = new Properties();\nprops.setProperty(PropertyKeyConst.SERVER_ADDR, \"127.0.0.1:8848\");\nprops.setProperty(PropertyKeyConst.USERNAME, \"nacos\");\nprops.setProperty(PropertyKeyConst.PASSWORD, \"nacos\");\nNamingService naming = NamingFactory.createNamingService(props);","handlingStrategy":"try-catch","validationCode":"// Java SDK: ensure credentials are configured before creating the service\nProperties props = new Properties();\nprops.setProperty(PropertyKeyConst.SERVER_ADDR, serverAddr);\nif (authEnabled) {\n  props.setProperty(PropertyKeyConst.USERNAME, username);\n  props.setProperty(PropertyKeyConst.PASSWORD, password);\n  // or: props.setProperty(PropertyKeyConst.ACCESS_TOKEN, token);\n}","typeGuard":null,"tryCatchPattern":"try {\n  namingService.registerInstance(serviceName, ip, port);\n} catch (NacosException e) {\n  if (e.getErrCode() == NacosException.NO_RIGHT) {\n    // identity validation failed — refresh token / check credentials\n    refreshCredentials();\n  }\n}","preventionTips":["Configure username/password or AccessToken in the client SDK when auth is enabled.","For server-identity auth, ensure identity headers match the server config.","Refresh tokens before they expire.","Ensure the client auth plugin type matches the server."],"tags":["auth","authentication","java","grpc","remote-filter","sdk","security"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}