{"record":{"id":"bab09c02ceaa6deb","repo":"alibaba/nacos","slug":"no-valid-oidc-token-found","errorCode":null,"errorMessage":"No valid OIDC token found","messagePattern":"No valid OIDC token found","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/OidcAuthenticationManager.java","lineNumber":99,"sourceCode":"    \n    /**\n     * Authenticate user from identity context.\n     *\n     * @param identityContext identity context containing credentials\n     * @return authenticated OidcUser\n     * @throws AccessException if authentication fails\n     */\n    public OidcUser authenticate(IdentityContext identityContext) throws AccessException {\n        // Try to extract Bearer token from Authorization header\n        String token = extractBearerToken(identityContext);\n        \n        if (StringUtils.isBlank(token)) {\n            // Try accessToken parameter\n            token = identityContext.getParameter(OidcProtocolConstants.ACCESS_TOKEN_PARAM, \"\");\n        }\n        \n        if (StringUtils.isBlank(token)) {\n            throw new AccessException(\"No valid OIDC token found\");\n        }\n        \n        return authenticate(token);\n    }\n    \n    /**\n     * Extract Bearer token from identity context.\n     *\n     * @param identityContext identity context\n     * @return token string or null\n     */\n    private String extractBearerToken(IdentityContext identityContext) {\n        String authHeader =\n            identityContext.getParameter(OidcProtocolConstants.AUTHORIZATION_HEADER, \"\");\n        if (StringUtils.isNotBlank(authHeader)\n            && authHeader.startsWith(OidcProtocolConstants.BEARER_PREFIX)) {\n            return authHeader.substring(OidcProtocolConstants.BEARER_PREFIX.length());\n        }","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/OidcAuthenticationManager.java#L81-L117","documentation":"Thrown by OidcAuthenticationManager.authenticate(IdentityContext) after both token sources are exhausted: no 'Authorization: Bearer ...' header and no accessToken query/form parameter. It means the incoming request carried no OIDC credential at all.","triggerScenarios":"A request to a protected Nacos resource that has neither an Authorization: Bearer header nor an 'accessToken' parameter in the identity context.","commonSituations":"Client forgot to attach the access token; token expired and the client sent no token; a browser hitting an API endpoint without a session; misconfigured gateway stripping the Authorization header.","solutions":["Ensure the client sends 'Authorization: Bearer <oidc-access-token>' on every authenticated request.","If using the parameter fallback, supply accessToken in the request.","Check that an intermediary (reverse proxy, gateway) is not stripping the Authorization header.","Confirm the OIDC login flow completed and the client obtained a token before calling protected endpoints."],"exampleFix":"// before: request sent with no credentials\nGET /v3/admin/ns/service/list\n// after: attach the OIDC access token\nGET /v3/admin/ns/service/list\nAuthorization: Bearer eyJhbGciOi...","handlingStrategy":"validation","validationCode":"// Pre-check both credential sources before calling authenticate\nString bearer = extractBearer(identityContext);\nString param = identityContext.getParameter(OidcProtocolConstants.ACCESS_TOKEN_PARAM, \"\");\nif (StringUtils.isBlank(bearer) && StringUtils.isBlank(param)) {\n    respondUnauthorized(); // return 401 instead of letting authenticate throw\n}","typeGuard":null,"tryCatchPattern":"try {\n    manager.authenticate(identityContext);\n} catch (AccessException e) {\n    if (\"No valid OIDC token found\".equals(e.getMessage())) {\n        // No credentials present — standard 401, not a server error\n        respondUnauthorized();\n    } else {\n        throw e;\n    }\n}","preventionTips":["Ensure clients always send 'Authorization: Bearer <token>'.","Verify gateways/proxies forward the Authorization header unchanged.","Distinguish 'no token' (401) from 'invalid token' (401 with different message) in error handling."],"tags":["oidc","authentication","validation"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}