{"record":{"id":"dae330b42f5cf76d","repo":"alibaba/nacos","slug":"token-is-required","errorCode":null,"errorMessage":"Token is required","messagePattern":"Token is required","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/OidcAuthenticationManager.java","lineNumber":68,"sourceCode":"    private final AuthorizationClient authorizationClient;\n    \n    public OidcAuthenticationManager(JwtTokenValidator tokenValidator,\n        OidcUserMapper userMapper, AuthorizationClient authorizationClient) {\n        this.tokenValidator = tokenValidator;\n        this.userMapper = userMapper;\n        this.authorizationClient = authorizationClient;\n    }\n    \n    /**\n     * Authenticate user by JWT token.\n     *\n     * @param token JWT token (Access Token or ID Token)\n     * @return authenticated OidcUser\n     * @throws AccessException if authentication fails\n     */\n    public OidcUser authenticate(String token) throws AccessException {\n        if (StringUtils.isBlank(token)) {\n            throw new AccessException(\"Token is required\");\n        }\n        \n        // Validate the token\n        JWTClaimsSet claims = tokenValidator.validate(token);\n        \n        // Map claims to user\n        OidcUser user = userMapper.mapToUser(claims);\n        user.setToken(token);\n        \n        LOGGER.debug(\"User authenticated: {}\", user.getUsername());\n        return user;\n    }\n    \n    /**\n     * Authenticate user from identity context.\n     *\n     * @param identityContext identity context containing credentials\n     * @return authenticated OidcUser","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/OidcAuthenticationManager.java#L50-L86","documentation":"Thrown by OidcAuthenticationManager.authenticate(String) when the token argument is null, empty, or whitespace. It is the explicit pre-condition guard before token validation is attempted.","triggerScenarios":"A direct call to authenticate(token) with a null/blank token — e.g. a controller extracted no token from the request and forwarded the empty value.","commonSituations":"Caller extracted a header that was absent and passed null downstream; a code path that bypasses the IdentityContext-based authenticate(IdentityContext) and calls the string overload directly without a null check.","solutions":["Null/blank-check the token before calling authenticate(String).","Prefer authenticate(IdentityContext) which already tries Bearer header and accessToken param before delegating.","Ensure the upstream extraction layer returns a non-null token or short-circuits with a 401."],"exampleFix":"// before\nOidcUser user = manager.authenticate(tokenFromHeader); // tokenFromHeader may be null\n// after\nif (StringUtils.isBlank(tokenFromHeader)) {\n    throw new AccessException(\"Missing Bearer token\");\n}\nOidcUser user = manager.authenticate(tokenFromHeader);","handlingStrategy":"validation","validationCode":"// Guard the string overload before calling\nif (StringUtils.isBlank(token)) {\n    throw new AccessException(\"Missing OIDC token in request\");\n}\nOidcUser user = manager.authenticate(token);","typeGuard":"// Narrow a nullable token to a non-blank one before authenticating\nString safeToken = (token != null && !token.trim().isEmpty()) ? token : null;\nif (safeToken == null) {\n    // handle missing token (401) instead of calling authenticate\n}","tryCatchPattern":"try {\n    manager.authenticate(token);\n} catch (AccessException e) {\n    if (\"Token is required\".equals(e.getMessage())) {\n        // caller bug: passed null/blank token — do not surface to user, return 401\n        respondUnauthorized();\n    } else {\n        throw e;\n    }\n}","preventionTips":["Prefer authenticate(IdentityContext), which handles missing tokens gracefully.","Null-check tokens at the controller boundary before forwarding to the manager.","Never assume a header is present — always treat token extraction as fallible."],"tags":["oidc","authentication","validation"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}