{"record":{"id":"601880de4328c3df","repo":"alibaba/nacos","slug":"token-invalid","errorCode":null,"errorMessage":"token invalid!","messagePattern":"token invalid!","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java","lineNumber":103,"sourceCode":"        MAP.put(HS384_JWT_HEADER, HS384);\n        MAP.put(HS512_JWT_HEADER, HS512);\n    }\n    \n    /**\n     * verify jwt.\n     *\n     * @param jwt complete jwt string\n     * @param key for signature\n     * @return object for payload\n     * @throws AccessException access exception\n     */\n    public static NacosUser verify(String jwt, Key key) throws AccessException {\n        if (StringUtils.isBlank(jwt)) {\n            throw new AccessException(\"user not found!\");\n        }\n        String[] split = jwt.split(\"\\\\.\");\n        if (split.length != JWT_PARTS) {\n            throw new AccessException(\"token invalid!\");\n        }\n        String header = split[HEADER_POSITION];\n        String payload = split[PAYLOAD_POSITION];\n        String signature = split[SIGNATURE_POSITION];\n        \n        NacosSignatureAlgorithm signatureAlgorithm = MAP.get(header);\n        if (signatureAlgorithm == null) {\n            throw new AccessException(\"unsupported signature algorithm\");\n        }\n        NacosUser user = signatureAlgorithm.verify(header, payload, signature, key);\n        user.setToken(jwt);\n        return user;\n    }\n    \n    /**\n     * verify jwt.\n     *\n     * @param header    header of jwt","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java#L85-L121","documentation":"Thrown by NacosSignatureAlgorithm.verify() as an AccessException when the JWT string does not split into exactly three dot-separated parts (header.payload.signature). Any token that is not structurally a compact JWT is rejected before algorithm selection.","triggerScenarios":"jwt.split(\"\\\\.\").length != 3 — the token has too few or too many dots; e.g., a plain opaque token, a JSON string, a token with an extra trailing dot, or a truncated token.","commonSituations":"Passing an opaque session id instead of a JWT; a token truncated by a header-length limit or copy-paste; a token with embedded base64 content containing an unexpected dot count after corruption.","solutions":["Ensure the value passed to verify() is a complete three-part compact JWT.","Log jwt.split(\".\").length during debugging to confirm the part count.","Regenerate/re-issue the token if it was corrupted in transit."],"exampleFix":"// before\nString jwt = \"abc123\"; // opaque, not a JWT -> error 1276\nNacosSignatureAlgorithm.verify(jwt, key);\n\n// after\nString jwt = loginResponse.getAccessToken(); // proper ey...eyJ...sig JWT\nNacosSignatureAlgorithm.verify(jwt, key);","handlingStrategy":"validation","validationCode":"if (jwt == null || jwt.split(\"\\\\.\").length != 3) {\n    throw new AccessException(\"token invalid!\");\n}\nNacosSignatureAlgorithm.verify(jwt, key);","typeGuard":null,"tryCatchPattern":"try {\n    NacosSignatureAlgorithm.verify(jwt, key);\n} catch (AccessException e) {\n    if (\"token invalid!\".equals(e.getMessage())) {\n        // not a compact JWT — prompt re-login\n    }\n    throw e;\n}","preventionTips":["Validate the JWT has exactly two dots (three parts) before verifying.","Do not pass opaque session ids or raw JSON to verify().","Use tokens issued exclusively by Nacos."],"tags":["auth","jwt","token","validation"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}