{"record":{"id":"5f2de8f60c465d93","repo":"alibaba/nacos","slug":"token-expired","errorCode":null,"errorMessage":"token expired!","messagePattern":"token expired!","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java","lineNumber":143,"sourceCode":"     * @return object for payload\n     * @throws AccessException access exception\n     */\n    public NacosUser verify(String header, String payload, String signature, Key key)\n        throws AccessException {\n        Mac macInstance = getMacInstance(key);\n        byte[] bytes = macInstance\n            .doFinal((header + JWT_SEPERATOR + payload).getBytes(StandardCharsets.US_ASCII));\n        if (!URL_BASE64_ENCODER.encodeToString(bytes).equals(signature)) {\n            throw new AccessException(\"Invalid signature\");\n        }\n        NacosJwtPayload nacosJwtPayload =\n            JacksonUtils.toObj(URL_BASE64_DECODER.decode(payload), NacosJwtPayload.class);\n        if (nacosJwtPayload.getExp() >= TimeUnit.MILLISECONDS\n            .toSeconds(System.currentTimeMillis())) {\n            return new NacosUser(nacosJwtPayload.getSub());\n        }\n        \n        throw new AccessException(\"token expired!\");\n    }\n    \n    /**\n     * get jwt expire time in seconds.\n     *\n     * @param jwt complete jwt string\n     * @param key for signature\n     * @return expire time in seconds\n     * @throws AccessException access exception\n     */\n    public static long getExpiredTimeInSeconds(String jwt, Key key) throws AccessException {\n        if (StringUtils.isBlank(jwt)) {\n            throw new AccessException(\"user not found!\");\n        }\n        String[] split = jwt.split(\"\\\\.\");\n        if (split.length != JWT_PARTS) {\n            throw new AccessException(\"token invalid!\");\n        }","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java#L125-L161","documentation":"Thrown by NacosSignatureAlgorithm.verify() as an AccessException when the JWT passed signature verification but its exp (expiration) claim is in the past relative to the current wall-clock time (compared in epoch seconds). The token is valid in structure and signature but has expired.","triggerScenarios":"After a successful HMAC match, nacosJwtPayload.getExp() < TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis()), so the method throws instead of returning a NacosUser.","commonSituations":"The token's lifetime elapsed (default 18000s/~5h); client clock skew; a long-running operation that outlived the token; server clock drifted forward.","solutions":["Refresh the token by re-authenticating before the expiry window closes.","Increase token.expire.seconds if the workload legitimately needs longer-lived tokens.","Verify server/client clocks are synchronized (NTP) to avoid false expiries."],"exampleFix":"// before\nconst token = getTokenFromCache(); // may be hours old\nclient.callApi({ Authorization: `Bearer ${token}` });\n// -> token expired!\n\n// after\nif (isExpired(token)) token = await login();\nclient.callApi({ Authorization: `Bearer ${token}` });","handlingStrategy":"validation","validationCode":"String[] parts = jwt.split(\"\\\\.\");\nlong exp = JacksonUtils.toObj(\n    new String(Base64.getUrlDecoder().decode(parts[1]), StandardCharsets.UTF_8),\n    NacosJwtPayload.class).getExp();\nlong now = TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis());\nif (exp < now) {\n    throw new AccessException(\"token expired!\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    NacosSignatureAlgorithm.verify(jwt, key);\n} catch (AccessException e) {\n    if (\"token expired!\".equals(e.getMessage())) {\n        jwt = relogin(); // refresh then retry once\n        NacosSignatureAlgorithm.verify(jwt, key);\n    }\n}","preventionTips":["Refresh tokens before exp; track exp client-side and proactively re-login.","Keep server clocks NTP-synced to avoid false expiries.","Increase token.expire.seconds if longer-lived tokens are warranted."],"tags":["auth","jwt","token","expiry"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}