{"record":{"id":"7b453dae4dabfeb8","repo":"theonedev/onedev","slug":"invalid-or-expired-access-token","errorCode":null,"errorMessage":"Invalid or expired access token","messagePattern":"Invalid or expired access token","errorType":"exception","errorClass":"IncorrectCredentialsException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/security/BearerAuthenticationFilter.java","lineNumber":66,"sourceCode":"    \tSubject subject = SecurityUtils.getSubject();\n\t\tif (!subject.isAuthenticated()) {\n\t\t\tString bearerToken = SecurityUtils.getBearerToken((HttpServletRequest)request);\n\t\t\tif (bearerToken != null) {\n\t\t\t\tif (clusterService.getCredential().equals(bearerToken)) {\n\t\t\t\t\tThreadContext.bind(userService.getSystem().asSubject());\n\t\t\t\t} else {\n\t\t\t\t\tvar accessToken = accessTokenService.findByValue(bearerToken);\n\t\t\t\t\tif (accessToken != null) {\n\t\t\t\t\t\tThreadContext.bind(accessToken.asSubject());\n\t\t\t\t\t} else {\n\t\t\t\t\t\tvar workspaceContext = workspaceService.getWorkspaceContext(bearerToken, false);\n\t\t\t\t\t\tif (workspaceContext != null) {\n\t\t\t\t\t\t\tvar workspace = workspaceService.load(workspaceContext.getWorkspaceId());\n\t\t\t\t\t\t\tThreadContext.bind(workspace.getUser().asSubject());\n\t\t\t\t\t\t\tProjectEvent.setContextualParticipatingUserIds(workspace.getParticipatingUserIds());\n\t\t\t\t\t\t} else if (agentTokenService.find(bearerToken) == null \n\t\t\t\t\t\t\t\t&& jobService.getJobContext(bearerToken, false) == null) {\n\t\t\t\t\t\t\tthrow new IncorrectCredentialsException(\"Invalid or expired access token\");\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t        } \n\t\t}\n\t\treturn true;\n\t}\n\n\t@Override\n\tprotected void cleanup(ServletRequest request, ServletResponse response, Exception existing)\n\t\t\tthrows ServletException, IOException {\n\t\ttry {\n\t\t\tsuper.cleanup(request, response, existing);\n\t\t} finally {\n\t\t\tProjectEvent.clearContextualParticipatingUserIds();\n\t\t}\n\t}\n","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/security/BearerAuthenticationFilter.java#L48-L84","documentation":"BearerAuthenticationFilter authenticates requests carrying a Bearer token. If the token matches no access token, agent token, or active job context, it throws IncorrectCredentialsException('Invalid or expired access token'), which Shiro treats as failed authentication.","triggerScenarios":"HTTP request with an Authorization: Bearer header whose token is not a valid access token, agent token, or job execution token (e.g. hitting the REST/API endpoint with a stale token).","commonSituations":"Access token revoked or expired; token rotated in user profile; using an API token from another OneDev instance; agents reinstalled with new tokens; CI job token used after job completion.","solutions":["Generate a fresh access token from user profile > Access Tokens and update the client.","Verify the token belongs to the correct OneDev instance.","For agents, re-sync the agent token after re-registration.","Check the Authorization header format is exactly 'Bearer <token>' with no extra whitespace."],"exampleFix":"// before\ncurl -H \"Authorization: Bearer old-expired-token\" https://onedev/api/projects\n// after\ncurl -H \"Authorization: Bearer <newly-generated-token>\" https://onedev/api/projects","handlingStrategy":"try-catch","validationCode":"if (bearerToken == null || bearerToken.isBlank()) throw new IllegalArgumentException(\"Missing bearer token\");\n// Optionally probe the token against the API before real use","typeGuard":null,"tryCatchPattern":"try {\n    // request with Authorization: Bearer <token>\n} catch (UnauthenticatedException | IncorrectCredentialsException e) {\n    // refresh token and retry once\n}","preventionTips":["Rotate and store access tokens securely with expiry tracking","Re-fetch tokens after revocation, user logout, or job completion","Verify the 'Bearer ' header prefix and token instance match"],"tags":["authentication","bearer-token","security"],"backgroundTag":"invalid-or-expired-access-token","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}