{"record":{"id":"a75afa7073a30dd8","repo":"alibaba/nacos","slug":"token-signature-verification-failed","errorCode":null,"errorMessage":"Token signature verification failed","messagePattern":"Token signature verification failed","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":192,"sourceCode":"        try {\n            // Refresh JWKS\n            JWKSet jwkSet = jwksProvider.refreshJwkSet();\n            \n            // Recreate processor with new keys\n            synchronized (this) {\n                this.jwtProcessor = createJwtProcessor(jwkSet);\n            }\n            \n            // Validate using new processor\n            JWTClaimsSet claims = this.jwtProcessor.process(token, null);\n            validateClaims(claims);\n            \n            LOGGER.info(\"Token validated successfully after JWKS refresh\");\n            return claims;\n            \n        } catch (Exception e) {\n            LOGGER.warn(\"Token validation failed even after JWKS refresh: {}\", e.getMessage());\n            throw new AccessException(\"Token signature verification failed\");\n        }\n    }\n    \n    /**\n     * Perform additional claims validation.\n     *\n     * @param claims JWT claims\n     * @throws AccessException if validation fails\n     */\n    private void validateClaims(JWTClaimsSet claims) throws AccessException {\n        // Validate expiration\n        Date expirationTime = claims.getExpirationTime();\n        if (expirationTime == null || expirationTime.before(new Date())) {\n            throw new AccessException(\"Token has expired\");\n        }\n        \n        // Validate not before (if present)\n        Date notBeforeTime = claims.getNotBeforeTime();","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L174-L210","documentation":"Thrown at the end of retryWithRefreshedJwks after a BadJOSEException triggered a one-shot JWKS refresh and the retry still failed. It signals that the token's signature does not verify against any current key from the IdP.","triggerScenarios":"Initial signature verification failed (BadJOSEException), the validator refreshed the JWKS from the IdP, recreated the processor, re-ran process()/validateClaims(), and that also threw. The generic catch(Exception) collapses any retry failure into this message.","commonSituations":"Token was minted by a different/stale IdP or environment; key rotation is complete but the client holds a token signed by a retired key; token was tampered with; the token's kid references a key never published in JWKS; clock/claims issue surfaced on retry.","solutions":["Have the client obtain a fresh token from the correct IdP and retry.","Confirm the token's issuer matches the configured issuer-uri (cross-environment token reuse is a common cause).","Verify the IdP JWKS still contains the key matching the token's kid.","Inspect the preceding WARN log 'Token validation failed even after JWKS refresh: ...' for the underlying cause.","If the issue persists, check whether the token validation method should be 'introspection' instead of 'jwt'."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    validator.validate(token);\n} catch (AccessException e) {\n    if (\"Token signature verification failed\".equals(e.getMessage())) {\n        // ask client to obtain a fresh token from the correct IdP\n    }\n    throw e;\n}","preventionTips":["Issue tokens from the IdP matching the configured issuer-uri.","After IdP key rotation, have clients refresh tokens to pick up new keys.","Confirm the token kid is present in the current JWKS."],"tags":["oidc","jwt","signature","key-rotation","jwks"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}