{"record":{"id":"7b493afbae268115","repo":"alibaba/nacos","slug":"token-validation-failed","errorCode":null,"errorMessage":"Token validation failed: ","messagePattern":"Token validation failed: ","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":124,"sourceCode":"        } catch (ParseException e) {\n            LOGGER.warn(\"Failed to parse JWT token: {}\", e.getMessage());\n            throw new AccessException(\"Invalid token format\");\n        } catch (BadJOSEException e) {\n            LOGGER.warn(\"JWT signature verification failed: {}\", e.getMessage());\n            // Try refreshing JWKS and retry once (key rotation scenario)\n            return retryWithRefreshedJwks(token, e);\n        } catch (JOSEException e) {\n            LOGGER.warn(\"JWT processing error: {}\", e.getMessage());\n            throw new AccessException(\"Token processing error\");\n        } catch (AccessException e) {\n            throw e;\n        } catch (IllegalArgumentException | NullPointerException e) {\n            LOGGER.error(\"Invalid token data: {}\", e.getMessage(), e);\n            throw new AccessException(\"Invalid token format: \" + e.getMessage());\n        } catch (Exception e) {\n            LOGGER.error(\"Unexpected error during token validation: {} - {}\",\n                e.getClass().getSimpleName(), e.getMessage(), e);\n            throw new AccessException(\"Token validation failed: \" + e.getClass().getSimpleName());\n        }\n    }\n    \n    private ConfigurableJWTProcessor<SecurityContext> getJwtProcessor() throws AccessException {\n        if (jwtProcessor == null) {\n            synchronized (this) {\n                if (jwtProcessor == null) {\n                    try {\n                        jwtProcessor = createJwtProcessor(jwksProvider.getJwkSet());\n                    } catch (IOException e) {\n                        throw new AccessException(\n                            \"Failed to initialize JWT processor: \" + e.getMessage());\n                    }\n                }\n            }\n        }\n        return jwtProcessor;\n    }","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L106-L142","documentation":"The terminal catch(Exception) fallback inside validate(). It fires for any throwable not matched by the more specific branches (ParseException, BadJOSEException, JOSEException, AccessException, IAE/NPE). The exception's simple class name is appended so the cause is identifiable in logs.","triggerScenarios":"An unexpected runtime exception propagates from processor.process(), validateClaims(), or getJwtProcessor() — e.g. a ClassCastException on a claim typed incorrectly, a NumberFormatException, or a RuntimeException from a misbehaving library.","commonSituations":"Rare; usually indicates a token with an exotic claim shape, a library version incompatibility, or a genuine bug. The appended class name (e.g. 'Token validation failed: ClassCastException') is the primary diagnostic.","solutions":["Read the appended exception class name and the matching ERROR log line (full stack trace is logged).","Reproduce with the exact token and decode its claims to look for unusual types/structures.","Check for nimbusds library version mismatches on the classpath.","If it is a bug, file an issue with the token (redacted) and stack trace.","Add a more specific catch branch upstream if a known exception type recurs."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    validator.validate(token);\n} catch (AccessException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Token validation failed: \")) {\n        // unexpected; log full stack trace (already ERROR-logged) and surface 500/401\n    }\n    throw e;\n}","preventionTips":["Capture the appended exception class name to triage.","Keep nimbusds versions aligned across the classpath.","Report recurring unexpected types so a specific catch branch can be added."],"tags":["oidc","jwt","error","unexpected"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}