{"record":{"id":"eaa3e41a4922cefe","repo":"spring-projects/spring-security","slug":"provided-token-isn-t-active-eaa3e4","errorCode":null,"errorMessage":"Provided token isn't active","messagePattern":"Provided token isn't active","errorType":"exception","errorClass":"BadOpaqueTokenException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java","lineNumber":191,"sourceCode":"\t\tMap<String, Object> claims = responseEntity.getBody();\n\t\t// relying solely on the authorization server to validate this token (not checking\n\t\t// 'exp', for example)\n\t\tif (claims == null) {\n\t\t\treturn Collections.emptyMap();\n\t\t}\n\n\t\tboolean active = (boolean) claims.compute(OAuth2TokenIntrospectionClaimNames.ACTIVE, (k, v) -> {\n\t\t\tif (v instanceof String) {\n\t\t\t\treturn Boolean.parseBoolean((String) v);\n\t\t\t}\n\t\t\tif (v instanceof Boolean) {\n\t\t\t\treturn v;\n\t\t\t}\n\t\t\treturn false;\n\t\t});\n\t\tif (!active) {\n\t\t\tthis.logger.trace(\"Did not validate token since it is inactive\");\n\t\t\tthrow new BadOpaqueTokenException(\"Provided token isn't active\");\n\t\t}\n\t\treturn claims;\n\t}\n\n\tprivate ArrayListFromStringClaimAccessor convertClaimsSet(Map<String, Object> claims) {\n\t\tMap<String, Object> converted = new LinkedHashMap<>(claims);\n\t\tconverted.computeIfPresent(OAuth2TokenIntrospectionClaimNames.AUD, (k, v) -> {\n\t\t\tif (v instanceof String) {\n\t\t\t\treturn Collections.singletonList(v);\n\t\t\t}\n\t\t\treturn v;\n\t\t});\n\t\tconverted.computeIfPresent(OAuth2TokenIntrospectionClaimNames.CLIENT_ID, (k, v) -> v.toString());\n\t\tconverted.computeIfPresent(OAuth2TokenIntrospectionClaimNames.EXP,\n\t\t\t\t(k, v) -> Instant.ofEpochSecond(((Number) v).longValue()));\n\t\tconverted.computeIfPresent(OAuth2TokenIntrospectionClaimNames.IAT,\n\t\t\t\t(k, v) -> Instant.ofEpochSecond(((Number) v).longValue()));\n\t\t// RFC-7662 page 7 directs users to RFC-7519 for defining the values of these","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java#L173-L209","documentation":"SpringOpaqueTokenIntrospector (formerly NimbusOpaqueTokenIntrospector) adapts the Nimbus introspection response and requires the 'active' claim to be true; otherwise it throws BadOpaqueTokenException('Provided token isn't active'). RFC 7662 mandates that inactive tokens carry active=false, and Spring Security treats this as authentication failure.","triggerScenarios":"introspect() receives an introspection response with active=false/missing for the presented opaque token — expired, revoked, wrong AS, or not-yet-valid token.","commonSituations":"Expired or revoked tokens in cached clients; dev/prod introspection endpoint mismatch; AS-side cleanup deleting the token record; tokens issued before a rotation of signing/introspection config.","solutions":["Inspect the raw introspection response (curl the /introspect endpoint) to confirm active and related claims","Obtain a new access token","Validate issuer/environment configuration of SpringOpaqueTokenIntrospector (introspectionUri, clientId, clientSecret)","Check AS logs for revocation or expiry of the token"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// verify active claim directly before authenticating\nMap claims = httpGET(introspectionUri, token);\nif (!Boolean.TRUE.equals(claims.get(\"active\"))) refreshAccessToken();","typeGuard":null,"tryCatchPattern":"try {\n    OAuth2AuthenticatedPrincipal p = introspector.introspect(token);\n} catch (BadOpaqueTokenException e) {\n    log.warn(\"Token inactive: {}\", e.getMessage());\n    throw new UnauthorizedException(\"Token is not active\", e);\n}","preventionTips":["Use short-lived tokens with proactive refresh","Keep clocks synced to avoid nbf/exp edge cases","Confirm the SpringOpaqueTokenIntrospector points at the issuing AS"],"tags":["oauth2","opaque-token","introspection","rfc-7662"],"backgroundTag":"invalid-bearer-token","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}