{"record":{"id":"f1c2f6a0e57cc24a","repo":"alibaba/nacos","slug":"code-d-message-s","errorCode":null,"errorMessage":"Code: %d, Message: %s.","messagePattern":"Code: (.+?), Message: (.+?)\\.","errorType":"http","errorClass":"AccessException","httpStatus":403,"severity":"error","filePath":"core/src/main/java/com/alibaba/nacos/core/auth/AbstractWebAuthFilter.java","lineNumber":144,"sourceCode":"            requestContext.getAuthContext().setAuthResult(result);\n            if (!result.isSuccess()) {\n                throw new AccessException(result.format());\n            }\n            if (isIdentityOnlyApi(secured)) {\n                if (Loggers.AUTH.isDebugEnabled()) {\n                    Loggers.AUTH.debug(\n                        \"API is identity only, skip validate authority, request: {} {}\",\n                        req.getMethod(),\n                        req.getRequestURI());\n                }\n                chain.doFilter(request, response);\n                return;\n            }\n            String action = secured.action().toString();\n            result = protocolAuthService.validateAuthority(identityContext,\n                new Permission(resource, action));\n            if (!result.isSuccess()) {\n                throw new AccessException(result.format());\n            }\n            chain.doFilter(request, response);\n        } catch (Exception e) {\n            handleFilterException(req, resp, method, e);\n        }\n    }\n    \n    private void handleFilterException(HttpServletRequest req, HttpServletResponse resp,\n        Method method, Exception e)\n        throws IOException, ServletException {\n        if (e instanceof AccessException accessException) {\n            if (Loggers.AUTH.isDebugEnabled()) {\n                Loggers.AUTH.debug(\"access denied, request: {} {}, reason: {}\", req.getMethod(),\n                    req.getRequestURI(),\n                    accessException.getErrMsg());\n            }\n            writeAccessDeniedResponse(resp, method, accessException.getErrMsg());\n            return;","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/core/src/main/java/com/alibaba/nacos/core/auth/AbstractWebAuthFilter.java#L126-L162","documentation":"Thrown by AbstractWebAuthFilter (servlet/web auth filter) at the authority-check stage. After identity validation passes, the filter calls protocolAuthService.validateAuthority(...) with the parsed resource and action (READ/WRITE); if the authenticated identity lacks permission, AuthResult.isSuccess() is false and an AccessException is thrown carrying result.format() (a 'Code: %d, Message: %s.' formatted string). This is an authorization (not authentication) denial on an HTTP request.","triggerScenarios":"An authenticated HTTP request (valid token/identity) to a @Secured endpoint where the user/role does not have the required permission for the resource+action. E.g. a read-only user POSTing to /v3/admin/ns/service, or a user without CONFIG write permission publishing a config. The identity check at line 128 passed; this is purely the authority check at line 144.","commonSituations":"Role-based permission missing for the resource namespace. User authenticated but not granted the specific action. Permission record deleted or mis-scoped. New API added without granting the role access.","solutions":["Grant the user/role the required permission (resource + action) in the auth system.","Verify the correct namespace/resource is being targeted — permissions are namespace-scoped.","Check that the token's identity maps to a user with the needed role.","If using server-identity bypass, confirm the identity header matches."],"exampleFix":"// No code fix — this is an access-control decision. Resolve by granting permission:\n// Via Nacos console or API:\n//   POST /v3/auth/permission  { role: 'developer', resource: 'namespaceId:*:s:*', action: 'w' }\n// Then retry the request.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Client side: detect 403 from the web auth filter and surface a permission message.\ntry {\n  await fetch(url, { headers: authHeaders() });\n} catch (e) {\n  // HTTP 403 bodies carry the AccessException formatted message\n}\n// Or inspect response.status === 403 and read the Result failure message.","preventionTips":["Grant the required permission (resource + action) to the user's role before calling secured APIs.","Verify the target namespace matches the user's permission scope.","Handle 403 responses with a clear 'insufficient permissions' message and a link to request access.","Audit new @Secured endpoints to ensure roles are granted access."],"tags":["auth","authorization","java","web-filter","permissions","http"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}