{"record":{"id":"55246182b3a8d313","repo":"alibaba/nacos","slug":"invalid-token-format-552461","errorCode":null,"errorMessage":"Invalid token format: ","messagePattern":"Invalid token format: ","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":120,"sourceCode":"            \n            LOGGER.debug(\"Token validated successfully for subject: {}\", claims.getSubject());\n            return claims;\n            \n        } catch (ParseException e) {\n            LOGGER.warn(\"Failed to parse JWT token: {}\", e.getMessage());\n            throw new AccessException(\"Invalid token format\");\n        } catch (BadJOSEException e) {\n            LOGGER.warn(\"JWT signature verification failed: {}\", e.getMessage());\n            // Try refreshing JWKS and retry once (key rotation scenario)\n            return retryWithRefreshedJwks(token, e);\n        } catch (JOSEException e) {\n            LOGGER.warn(\"JWT processing error: {}\", e.getMessage());\n            throw new AccessException(\"Token processing error\");\n        } catch (AccessException e) {\n            throw e;\n        } catch (IllegalArgumentException | NullPointerException e) {\n            LOGGER.error(\"Invalid token data: {}\", e.getMessage(), e);\n            throw new AccessException(\"Invalid token format: \" + e.getMessage());\n        } catch (Exception e) {\n            LOGGER.error(\"Unexpected error during token validation: {} - {}\",\n                e.getClass().getSimpleName(), e.getMessage(), e);\n            throw new AccessException(\"Token validation failed: \" + e.getClass().getSimpleName());\n        }\n    }\n    \n    private ConfigurableJWTProcessor<SecurityContext> getJwtProcessor() throws AccessException {\n        if (jwtProcessor == null) {\n            synchronized (this) {\n                if (jwtProcessor == null) {\n                    try {\n                        jwtProcessor = createJwtProcessor(jwksProvider.getJwkSet());\n                    } catch (IOException e) {\n                        throw new AccessException(\n                            \"Failed to initialize JWT processor: \" + e.getMessage());\n                    }\n                }","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L102-L138","documentation":"Thrown from catch(IllegalArgumentException | NullPointerException) when the token data itself is internally inconsistent in a way the processor surfaces as IAE/NPE — e.g. a null token slipping past the blank check via a non-String path, or a token with empty segments. The original exception message is appended.","triggerScenarios":"processor.process() or a downstream call raises IllegalArgumentException/NullPointerException: token has zero-length signature segment, the JSON object claim is malformed into an unexpected type, or a library-internal null check trips.","commonSituations":"A token like 'header.payload.' (empty signature), a token where the payload JSON is not an object, or a token produced by a non-standard encoder that emits segments NimbusDS does not tolerate.","solutions":["Inspect the appended message (e.g. '...: null key') to locate the exact invalid data.","Validate the token has exactly two dots and three non-empty base64URL segments before submitting.","Re-issue the token from a conformant IdP/encoder.","Decode the token payload manually to confirm it is a JSON object.","Check the server log 'Invalid token data: ...' which includes the full stack trace."],"exampleFix":"// before\nvalidator.validate(\"eyJhbGci.eyJzdWIi.\"); // empty signature segment\n\n// after: reject malformed tokens before validation\nif (token == null || token.split(\"\\\\.\").length != 3\n        || Arrays.stream(token.split(\"\\\\.\")).anyMatch(String::isEmpty)) {\n    throw new AccessException(\"Malformed JWT structure\");\n}\nvalidator.validate(token);","handlingStrategy":"validation","validationCode":"boolean wellFormedSegments(String t) {\n    if (t == null) return false;\n    String[] s = t.split(\"\\\\.\");\n    return s.length == 3 && !s[0].isEmpty() && !s[1].isEmpty() && !s[2].isEmpty();\n}\nif (!wellFormedSegments(token)) {\n    throw new AccessException(\"Malformed JWT\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    validator.validate(token);\n} catch (AccessException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Invalid token format: \")) {\n        // appended IAE/NPE reason guides the fix\n    }\n    throw e;\n}","preventionTips":["Reject tokens with empty header/payload/signature segments before validation.","Decode the payload to confirm it is a JSON object.","Treat any IAE/NPE from validation as malformed-input, not a transient fault."],"tags":["oidc","jwt","validation","null-safety"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}