{"record":{"id":"7b9a2628b01a6dd7","repo":"SonarSource/sonarqube","slug":"the-token-expired-on","errorCode":null,"errorMessage":"The token expired on ","messagePattern":"The token expired on ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/UserTokenAuthentication.java","lineNumber":123,"sourceCode":"          .build();\n      }\n      request.setAttribute(ACCESS_LOG_TOKEN_NAME, userToken.getName());\n      return new UserAuthResult(userDto, userToken, UserAuthResult.AuthType.TOKEN);\n    } catch (NotFoundException | IllegalStateException exception) {\n      throw AuthenticationException.newBuilder()\n        .setSource(AuthenticationEvent.Source.local(AuthenticationEvent.Method.SONARQUBE_TOKEN))\n        .setMessage(exception.getMessage())\n        .build();\n    }\n  }\n\n  private UserTokenDto authenticate(String token) {\n    UserTokenDto userToken = getUserToken(token);\n    if (userToken == null) {\n      throw new NotFoundException(\"Token doesn't exist\");\n    }\n    if (userToken.isExpired()) {\n      throw new IllegalStateException(\"The token expired on \" + formatDateTime(userToken.getExpirationDate()));\n    }\n    userLastConnectionDatesUpdater.updateLastConnectionDateIfNeeded(userToken);\n    return userToken;\n  }\n\n  @Nullable\n  public UserTokenDto getUserToken(String token) {\n    try (DbSession dbSession = dbClient.openSession(false)) {\n      return dbClient.userTokenDao().selectByTokenHash(dbSession, tokenGenerator.hash(token));\n    }\n  }\n}\n","sourceCodeStart":105,"sourceCodeEnd":136,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/UserTokenAuthentication.java#L105-L136","documentation":"UserTokenAuthentication.authenticate(token) checks the token's expiration date after loading it. If userToken.isExpired() is true, it throws IllegalStateException('The token expired on <date>'). The token exists in the database but is no longer valid because its set expiration date has passed.","triggerScenarios":"Authenticating with a user token that was created with an expiration date (e.g. 30/90-day token) and that date has passed. Common with CI tokens that expire unnoticed.","commonSituations":"Long-running pipelines or scheduled jobs whose stored token expired; team token-expiration policies in SonarQube (sonar.auth.token.expiration settings); users surprised by enforced expiry after upgrades.","solutions":["Generate a new token (optionally a longer or non-expiring one if policy allows) and update the pipeline/secret store","Check the expiration date in the error message / My Account > Security and plan rotation before it lapses","If expiration policies are too strict for service accounts, an administrator can adjust the token max lifetime server setting","Automate token rotation before the expiration date to prevent recurring failures"],"exampleFix":"// before\nSONAR_TOKEN=sqp_123...  # expired 2026-08-01\n// after\nSONAR_TOKEN=sqp_456...  # freshly generated, expiry 2027-01-01","handlingStrategy":"try-catch","validationCode":"// if using the API, check token expiry info where exposed; otherwise record expiry at creation time\nconst expiresAt = tokenMetadata.expiresAt; // stored when token was created\nif (expiresAt && Date.parse(expiresAt) <= Date.now()) throw new Error('SonarQube token expired; rotate before use');","typeGuard":"null","tryCatchPattern":"try {\n  await sonarRequest(token);\n} catch (err) {\n  if (/token expired on/i.test(err.response?.data?.errors?.[0]?.msg ?? '')) {\n    token = await rotateSonarToken();\n    return sonarRequest(token);\n  }\n  throw err;\n}","preventionTips":["Set calendar reminders aligned to each token's expiration date","Prefer no-expiry tokens only for tightly scoped service accounts if policy allows","Automate token rotation in CI before expiry","Align team token-max-lifetime settings with operational rotation capability"],"tags":["authentication","token-expired","sonarqube"],"backgroundTag":"jwt-token-expired","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}