{"record":{"id":"c31d3a3db2f9ffd3","repo":"alibaba/nacos","slug":"user-not-found","errorCode":null,"errorMessage":"user not found!","messagePattern":"user not found!","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java","lineNumber":99,"sourceCode":"    private final String header;\n    \n    static {\n        MAP.put(HS256_JWT_HEADER, HS256);\n        MAP.put(HS384_JWT_HEADER, HS384);\n        MAP.put(HS512_JWT_HEADER, HS512);\n    }\n    \n    /**\n     * verify jwt.\n     *\n     * @param jwt complete jwt string\n     * @param key for signature\n     * @return object for payload\n     * @throws AccessException access exception\n     */\n    public static NacosUser verify(String jwt, Key key) throws AccessException {\n        if (StringUtils.isBlank(jwt)) {\n            throw new AccessException(\"user not found!\");\n        }\n        String[] split = jwt.split(\"\\\\.\");\n        if (split.length != JWT_PARTS) {\n            throw new AccessException(\"token invalid!\");\n        }\n        String header = split[HEADER_POSITION];\n        String payload = split[PAYLOAD_POSITION];\n        String signature = split[SIGNATURE_POSITION];\n        \n        NacosSignatureAlgorithm signatureAlgorithm = MAP.get(header);\n        if (signatureAlgorithm == null) {\n            throw new AccessException(\"unsupported signature algorithm\");\n        }\n        NacosUser user = signatureAlgorithm.verify(header, payload, signature, key);\n        user.setToken(jwt);\n        return user;\n    }\n    ","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java#L81-L117","documentation":"Thrown by NacosSignatureAlgorithm.verify(jwt, key) as a com.alibaba.nacos.plugin.auth.exception.AccessException when the supplied JWT string is blank (null, empty, or whitespace). The method treats a missing token as 'no user present'. This is the first guard before any JWT parsing.","triggerScenarios":"verify() is called with a null/empty jwt — e.g., the Authorization header was missing and downstream code passed the raw (blank) token value straight into verify().","commonSituations":"A client omits the Authorization header; a filter extracts a token from the wrong header name and gets null; an integration passes the cookie value before it is set.","solutions":["Ensure the caller sends a non-empty Bearer token in the Authorization header.","Validate StringUtils.isBlank(jwt) before calling verify() and return a clear 401.","Check the token-extraction code path (header/cookie name) against the actual request."],"exampleFix":"// before\nString token = request.getHeader(\"Auth\"); // wrong header -> null\nNacosUser user = NacosSignatureAlgorithm.verify(token, key);\n\n// after\nString token = request.getHeader(\"Authorization\");\ntoken = token != null && token.startsWith(\"Bearer \") ? token.substring(7) : null;\nif (StringUtils.isBlank(token)) throw new AccessException(\"user not found!\");\nNacosUser user = NacosSignatureAlgorithm.verify(token, key);","handlingStrategy":"validation","validationCode":"if (StringUtils.isBlank(jwt)) {\n    throw new AccessException(\"user not found!\"); // or return 401 to the client\n}\nNacosSignatureAlgorithm.verify(jwt, key);","typeGuard":null,"tryCatchPattern":"try {\n    NacosUser user = NacosSignatureAlgorithm.verify(jwt, key);\n} catch (AccessException e) {\n    if (\"user not found!\".equals(e.getMessage())) {\n        // no token presented — respond 401 Unauthorized\n    }\n    throw e;\n}","preventionTips":["Guard verify() with a blank check and return a clear 401.","Verify the token-extraction header/cookie name is correct.","Never pass raw null/empty header values into verify()."],"tags":["auth","jwt","token"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}