{"record":{"id":"e5d0197b144f0f29","repo":"alibaba/nacos","slug":"token-is-not-yet-valid","errorCode":null,"errorMessage":"Token is not yet valid","messagePattern":"Token is not yet valid","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"warning","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":212,"sourceCode":"    }\n    \n    /**\n     * Perform additional claims validation.\n     *\n     * @param claims JWT claims\n     * @throws AccessException if validation fails\n     */\n    private void validateClaims(JWTClaimsSet claims) throws AccessException {\n        // Validate expiration\n        Date expirationTime = claims.getExpirationTime();\n        if (expirationTime == null || expirationTime.before(new Date())) {\n            throw new AccessException(\"Token has expired\");\n        }\n        \n        // Validate not before (if present)\n        Date notBeforeTime = claims.getNotBeforeTime();\n        if (notBeforeTime != null && notBeforeTime.after(new Date())) {\n            throw new AccessException(\"Token is not yet valid\");\n        }\n        \n        // Validate audience (if client ID is configured)\n        String clientId = config.getClientId();\n        if (StringUtils.isNotBlank(clientId)) {\n            List<String> audience = claims.getAudience();\n            if (audience != null && !audience.isEmpty() && !audience.contains(clientId)) {\n                // Check if 'azp' (authorized party) matches\n                String azp = (String) claims.getClaim(\"azp\");\n                if (!clientId.equals(azp)) {\n                    String message = String.format(\n                        \"Token audience mismatch. Expected: %s, Got: %s, azp: %s\",\n                        clientId, audience, azp);\n                    \n                    if (config.isStrictAudienceValidation()) {\n                        LOGGER.error(\"{} - Strict validation enabled, rejecting token. \"\n                            + \"This token may be intended for a different client.\", message);\n                        throw new AccessException(\"Token audience validation failed\");","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L194-L230","documentation":"Thrown by validateClaims when a 'nbf' (not-before) claim is present and is in the future relative to the server clock. The token is considered not yet active.","triggerScenarios":"claims.getNotBeforeTime() != null && notBeforeTime.after(new Date()).","commonSituations":"Clock skew: the Nacos server's clock is behind the IdP's, so a freshly issued token appears to start in the future; the IdP intentionally sets nbf slightly ahead; containers/VMs with unsynchronized clocks.","solutions":["Synchronize system clocks (NTP/chrony) on the Nacos host and the IdP.","Wait until the token's nbf time has passed, then retry.","If skew is unavoidable, request the IdP widen the nbf leeway or omit nbf.","Verify the server timezone and time source are correct."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"JWTClaimsSet preview = JWTClaimsSet.parse(new String(Base64.getUrlDecoder().decode(token.split(\"\\\\.\")[1])));\nDate nbf = preview.getNotBeforeTime();\nif (nbf != null && nbf.after(new Date())) {\n    // wait/retry after nbf, or fix clock skew\n}","typeGuard":null,"tryCatchPattern":"try {\n    validator.validate(token);\n} catch (AccessException e) {\n    if (\"Token is not yet valid\".equals(e.getMessage())) {\n        // likely clock skew; sync NTP, then retry\n    }\n    throw e;\n}","preventionTips":["Run NTP/chrony on all Nacos and IdP hosts.","Retry once after a short delay if nbf is only marginally in the future.","Confirm server timezone and time source are correct."],"tags":["oidc","jwt","clock-skew","claims","nbf"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}