{"record":{"id":"43e12f94c2ce0ba1","repo":"apache/incubator-seata","slug":"invalid-token-please-log-in-to-get-a-new-token","errorCode":null,"errorMessage":"Invalid token, please log in to get a new token","messagePattern":"Invalid token, please log in to get a new token","errorType":"exception","errorClass":"AuthenticationFailedException","httpStatus":401,"severity":"error","filePath":"console/src/main/java/org/apache/seata/mcp/service/impl/ConsoleRemoteServiceImpl.java","lineNumber":85,"sourceCode":"            JwtTokenUtils jwtTokenUtils,\n            @Qualifier(\"consoleRestClient\") RestClient restClient,\n            ObjectMapper objectMapper,\n            NamingServerProperties namingServerProperties) {\n        this.jwtTokenUtils = jwtTokenUtils;\n        this.restClient = restClient;\n        this.objectMapper = objectMapper;\n        this.namingServerProperties = namingServerProperties;\n        LOGGER.info(\"ConsoleRemoteServiceImpl initialized.\");\n    }\n\n    public String getToken() {\n        Authentication auth = SecurityContextHolder.getContext().getAuthentication();\n        if (auth == null || !auth.isAuthenticated()) {\n            throw new AuthenticationFailedException(\"No right to be identified\");\n        }\n        String originJwt = (String) auth.getCredentials();\n        if (!jwtTokenUtils.validateToken(originJwt)) {\n            throw new AuthenticationFailedException(\"Invalid token, please log in to get a new token\");\n        }\n        return WebSecurityConfig.TOKEN_PREFIX + originJwt;\n    }\n\n    public void setNamespaceHeaderAndQueryParam(\n            NameSpaceDetail nameSpaceDetail, HttpHeaders headers, Map<String, String> queryParams) {\n        headers.add(\"x-seata-namespace\", nameSpaceDetail.getNamespace());\n        if (StringUtils.isNotBlank(nameSpaceDetail.getvGroup())) {\n            if (queryParams != null) {\n                queryParams.put(\"vGroup\", nameSpaceDetail.getvGroup());\n            }\n            return;\n        }\n        if (nameSpaceDetail.getCluster() != null) {\n            headers.add(\"x-seata-cluster\", nameSpaceDetail.getCluster());\n        }\n    }\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apache/incubator-seata/blob/e01f97c6db397165050caa6764020410c2c8199a/console/src/main/java/org/apache/seata/mcp/service/impl/ConsoleRemoteServiceImpl.java#L67-L103","documentation":"ConsoleRemoteServiceImpl.getToken throws AuthenticationFailedException when the credential string from the security context fails jwtTokenUtils.validateToken — i.e. the JWT is malformed, expired, or signature-invalid. This guards the forwarding of the caller's token to the naming server/TC, rejecting stale credentials before any remote hop.","triggerScenarios":"Any console/MCP remote call made with a JWT past its expiry (ttl exceeded), a token signed with a different key (e.g. after server secret rotation), or a truncated/corrupted Authorization header value.","commonSituations":"Long-running console or MCP sessions outliving the token TTL; seata-server restarted with a regenerated JWT secret so old tokens fail signature validation; proxies stripping or mangling the Authorization header.","solutions":["Log in again to obtain a fresh token — the message itself instructs this as the primary remedy","If tokens expire too quickly, increase the JWT ttl setting on the console","After changing the JWT secret, distribute the same secret to all console/naming-server nodes so issued tokens validate everywhere","Verify the Authorization header arrives intact ('Bearer <jwt>') through any gateway/proxy"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!jwtTokenUtils.validateToken(currentToken)) { refreshToken(); }","typeGuard":null,"tryCatchPattern":"try { token = service.getToken(); } catch (AuthenticationFailedException e) { relogin(); token = service.getToken(); }","preventionTips":["Re-authenticate proactively when approaching token TTL","Keep the JWT secret identical across console and naming-server nodes","Surface a re-login prompt in tool clients on this specific message"],"tags":["seata","console","jwt","token-expiry"],"backgroundTag":null,"analyzedSha":"e01f97c6db397165050caa6764020410c2c8199a","analyzedAt":"2026-08-14T10:23:53.097Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}