{"record":{"id":"4bae904febe6715b","repo":"alibaba/nacos","slug":"failed-to-fetch-jwks-status","errorCode":null,"errorMessage":"Failed to fetch JWKS, status: ","messagePattern":"Failed to fetch JWKS, status: ","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwksProvider.java","lineNumber":114,"sourceCode":"     */\n    public JWKSet refreshJwkSet() throws IOException {\n        jwksCache.invalidateAll();\n        return getJwkSet();\n    }\n    \n    private JWKSet fetchJwkSet() throws IOException {\n        String jwksUri = metadataProvider.getMetadata().getJwksUri();\n        if (StringUtils.isBlank(jwksUri)) {\n            throw new IOException(\"JWKS URI is not configured or discovered\");\n        }\n        LOGGER.info(\"Fetching JWKS from: {}\", jwksUri);\n        HttpRequest request = HttpRequest.newBuilder().uri(URI.create(jwksUri))\n            .header(\"Accept\", \"application/json\").GET().build();\n        try {\n            HttpResponse<String> response =\n                httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {\n                throw new IOException(\"Failed to fetch JWKS, status: \" + response.statusCode());\n            }\n            JWKSet result = JWKSet.parse(response.body());\n            LOGGER.info(\"Successfully fetched JWKS with {} keys\", result.getKeys().size());\n            return result;\n        } catch (InterruptedException e) {\n            Thread.currentThread().interrupt();\n            throw new IOException(\"JWKS fetch interrupted\", e);\n        } catch (ParseException e) {\n            throw new IOException(\"Failed to parse JWKS\", e);\n        }\n    }\n    \n    /**\n     * Clear the cached JWK set.\n     */\n    public void clearCache() {\n        jwksCache.invalidateAll();\n    }","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwksProvider.java#L96-L132","documentation":"Thrown when the JWKS HTTP GET returned a non-200 status. The status code is appended. Nacos built the JWKS URL from discovery but the endpoint rejected or failed the request.","triggerScenarios":"JwksProvider.getJwkSet() fetches <jwks_uri> and receives 404, 401/403, 500, etc. Occurs during JWT validation when the cache is cold or expired.","commonSituations":"jwks_uri from discovery is wrong/stale; JWKS endpoint requires authentication (non-standard); IdP down; key-rotation endpoint temporarily unavailable; corporate proxy blocking the JWKS host.","solutions":["curl the jwks_uri from the discovery doc and read the appended status code.","For 404: the jwks_uri in discovery is incorrect — fix the IdP discovery configuration.","For 401/403: ensure the JWKS endpoint is public per OIDC spec.","For 5xx: check IdP health and retry; the cache TTL (jwks-cache-ttl-seconds) means failures retry on next validation after expiry.","Verify outbound HTTPS connectivity from the Nacos host to the JWKS URL."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight: probe the JWKS endpoint status before relying on key fetch\n// (curl the jwks_uri and assert HTTP 200)","typeGuard":null,"tryCatchPattern":"try {\n    jwksProvider.getJwkSet();\n} catch (IOException e) {\n    if (e.getMessage().contains(\"status:\")) {\n        // transient IdP issue — the Caffeine cache will retry on next miss after TTL\n        log.warn(\"JWKS fetch non-200; will retry: {}\", e.getMessage());\n        jwksProvider.refreshJwkSet();\n    } else {\n        throw e;\n    }\n}","preventionTips":["curl the jwks_uri to confirm it returns 200 with a JWK Set.","Ensure the JWKS endpoint is public per OIDC spec (no auth required).","Keep jwks-cache-ttl-seconds reasonable so transient failures self-heal."],"tags":["oidc","network","jwks","idp-error"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}