{"record":{"id":"629171041435de06","repo":"spring-projects/spring-security","slug":"invalid-token-629171","errorCode":"invalid_token","errorMessage":"Invalid token","messagePattern":"Invalid token","errorType":"error_code","errorClass":"InvalidBearerTokenException","httpStatus":401,"severity":"error","filePath":"oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/JwtAuthenticationProvider.java","lineNumber":104,"sourceCode":"\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tBearerTokenAuthenticationToken bearer = (BearerTokenAuthenticationToken) authentication;\n\t\tJwt jwt = getJwt(bearer);\n\t\tAbstractAuthenticationToken token = this.jwtAuthenticationConverter.convert(jwt);\n\t\tAssert.notNull(token, \"token cannot be null\");\n\t\tif (token.getDetails() == null) {\n\t\t\ttoken.setDetails(bearer.getDetails());\n\t\t}\n\t\tthis.logger.debug(\"Authenticated token\");\n\t\treturn token;\n\t}\n\n\tprivate Jwt getJwt(BearerTokenAuthenticationToken bearer) {\n\t\ttry {\n\t\t\treturn this.jwtDecoder.decode(bearer.getToken());\n\t\t}\n\t\tcatch (BadJwtException failed) {\n\t\t\tthis.logger.debug(\"Failed to authenticate since the JWT was invalid\");\n\t\t\tthrow new InvalidBearerTokenException((failed.getMessage() != null) ? failed.getMessage() : \"Invalid token\",\n\t\t\t\t\tfailed);\n\t\t}\n\t\tcatch (JwtException failed) {\n\t\t\tthrow new AuthenticationServiceException(\n\t\t\t\t\t(failed.getMessage() != null) ? failed.getMessage() : \"Invalid token\", failed);\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<?> authentication) {\n\t\treturn BearerTokenAuthenticationToken.class.isAssignableFrom(authentication);\n\t}\n\n\tpublic void setJwtAuthenticationConverter(\n\t\t\tConverter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter) {\n\t\tAssert.notNull(jwtAuthenticationConverter, \"jwtAuthenticationConverter cannot be null\");\n\t\tthis.jwtAuthenticationConverter = jwtAuthenticationConverter;\n\t}","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/JwtAuthenticationProvider.java#L86-L122","documentation":"JwtAuthenticationProvider.getJwt() decodes the bearer token; when the decoder throws BadJwtException (structurally invalid JWT: bad signature format, unsupported alg, malformed claims), it is translated to InvalidBearerTokenException with message 'Invalid token' (or the BadJwtException's message), producing an OAuth2 invalid_token response. Other JwtExceptions (server-side issues like key fetch failures) become AuthenticationServiceException instead.","triggerScenarios":"Bearer token fails JwtDecoder.decode() with BadJwtException — malformed token, unsupported algorithm, expired/malformed claims depending on decoder — during JwtAuthenticationProvider.authenticate().","commonSituations":"Client sending a truncated or hand-edited JWT; expired token surfaced as 'Invalid token' by some decoders; issuer key rotation invalidating signatures; copy-paste errors losing part of the Authorization header value.","solutions":["Inspect the debug log line 'Failed to authenticate since the JWT was invalid' and the nested BadJwtException message for the root cause","Have the client obtain a fresh token from the Authorization Server","Decode the token at jwt.io to check header/payload structure","Verify the resource server decoder config (jwkSetUri reachable, algorithms) matches the issuer"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// check token has 3 segments and is not visibly expired before calling\nif (jwt.split(\"\\\\.\").length != 3) throw new IllegalStateException(\"Malformed JWT\");","typeGuard":null,"tryCatchPattern":"try {\n    Jwt jwt = decoder.decode(token);\n} catch (InvalidBearerTokenException e) {\n    // token structurally invalid — do not retry, re-authenticate\n    throw new UnauthorizedException(\"Token rejected\", e);\n} catch (AuthenticationServiceException e) {\n    // server-side issue (e.g. JWKS fetch failed) — safe to retry\n}","preventionTips":["Distinguish BadJwtException (client token bad) from JwtException (server config issue) in logs","Keep JWKS endpoint reachable and cache-refresh healthy","Refresh tokens client-side before expiry","Never hand-edit or truncate tokens (proxy URL-encoding issues)"],"tags":["oauth2","jwt","bearer-token","authentication"],"backgroundTag":"invalid-bearer-token","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}