{"record":{"id":"8eec3bb2939774a9","repo":"paascloud/paascloud-master","slug":"error-8eec3b","errorCode":null,"errorMessage":"刷新页面重试","messagePattern":"刷新页面重试","errorType":"http","errorClass":"ZuulException","httpStatus":403,"severity":"error","filePath":"paascloud-gateway/src/main/java/com/paascloud/gateway/filter/AuthHeaderFilter.java","lineNumber":102,"sourceCode":"\t\t\tdoSomething(requestContext);\n\t\t} catch (Exception e) {\n\t\t\tlog.error(\"AuthHeaderFilter - [FAIL] EXCEPTION={}\", e.getMessage(), e);\n\t\t\tthrow new BusinessException(ErrorCodeEnum.UAC10011041);\n\t\t}\n\t\treturn null;\n\t}\n\n\tprivate void doSomething(RequestContext requestContext) throws ZuulException {\n\t\tHttpServletRequest request = requestContext.getRequest();\n\t\tString requestURI = request.getRequestURI();\n\n\t\tif (OPTIONS.equalsIgnoreCase(request.getMethod()) || !requestURI.contains(AUTH_PATH) || !requestURI.contains(LOGOUT_URI) || !requestURI.contains(ALIPAY_CALL_URI)) {\n\t\t\treturn;\n\t\t}\n\t\tString authHeader = RequestUtil.getAuthHeader(request);\n\n\t\tif (PublicUtil.isEmpty(authHeader)) {\n\t\t\tthrow new ZuulException(\"刷新页面重试\", 403, \"check token fail\");\n\t\t}\n\n\t\tif (authHeader.startsWith(BEARER_TOKEN_TYPE)) {\n\t\t\trequestContext.addZuulRequestHeader(HttpHeaders.AUTHORIZATION, authHeader);\n\n\t\t\tlog.info(\"authHeader={} \", authHeader);\n\t\t\t// 传递给后续微服务\n\t\t\trequestContext.addZuulRequestHeader(CoreHeaderInterceptor.HEADER_LABEL, authHeader);\n\t\t}\n\t}\n\n}\n","sourceCodeStart":84,"sourceCodeEnd":115,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-gateway/src/main/java/com/paascloud/gateway/filter/AuthHeaderFilter.java#L84-L115","documentation":"AuthHeaderFilter.doSomething (a Zuul pre-filter) requires an Authorization header on requests it considers auth-related; RequestUtil.getAuthHeader(request) returned empty, so it throws ZuulException('刷新页面重试', 403, 'check token fail'). Note the guard uses OR (!contains) logic, so the filter only proceeds when the URI matches AUTH_PATH and none of LOGOUT_URI/ALIPAY_CALL_URI appear — the 403 means the client reached such a route without carrying a token header.","triggerScenarios":"Calling any gateway route whose URI contains AUTH_PATH (and not the logout/alipay-callback paths) via a non-OPTIONS method without an Authorization header — e.g. a browser page refresh after the frontend dropped its stored token, or a direct API call without the header.","commonSituations":"Frontend lost/expired its access token in localStorage and refreshes a protected page; calling gateway auth endpoints directly (curl/Postman) without setting Authorization; a proxy or BFF stripping the Authorization header; frontend routing sends requests through the gateway that should bypass it.","solutions":["Ensure the frontend attaches 'Authorization: Bearer <token>' to all gateway auth-path requests (check request interceptors)","Log in again to obtain a fresh token — the previous one may have expired or been cleared on refresh","Verify no intermediary (Nginx, Spring Cloud Gateway, CORS preflight handling) strips the Authorization header","If the endpoint should be public, adjust the filter's path guard so the URI is excluded from the auth check"],"exampleFix":"// before: fetch without token header\nfetch('/api/auth/user');\n// after: attach bearer token\nfetch('/api/auth/user', {\n  headers: { Authorization: 'Bearer ' + localStorage.getItem('token') }\n});","handlingStrategy":"validation","validationCode":"const token = localStorage.getItem('token');\nif (!token) {\n  router.push('/login');\n} else {\n  fetch(url, { headers: { Authorization: 'Bearer ' + token } });\n}","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch(authUrl, { headers: { Authorization: 'Bearer ' + token } });\n  if (res.status === 403) {\n    // header missing/rejected — re-authenticate\n    redirectToLogin();\n  }\n} catch (e) { redirectToLogin(); }","preventionTips":["Always attach the Authorization header via a global fetch/axios interceptor for auth-path routes","Redirect to login when the token is absent or expired instead of letting requests hit the gateway","Verify reverse proxies in front of Zuul forward the Authorization header (no header stripping)","Keep public endpoints (logout, callbacks) excluded from the filter's path guard"],"tags":["zuul","gateway","missing-header","auth"],"backgroundTag":"authentication-required","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}