{"record":{"id":"fe17421e71905d69","repo":"alibaba/nacos","slug":"invalid-signature","errorCode":null,"errorMessage":"Invalid signature","messagePattern":"Invalid signature","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java","lineNumber":134,"sourceCode":"    }\n    \n    /**\n     * verify jwt.\n     *\n     * @param header    header of jwt\n     * @param payload   payload of jwt\n     * @param signature signature of jwt\n     * @param key       for signature\n     * @return object for payload\n     * @throws AccessException access exception\n     */\n    public NacosUser verify(String header, String payload, String signature, Key key)\n        throws AccessException {\n        Mac macInstance = getMacInstance(key);\n        byte[] bytes = macInstance\n            .doFinal((header + JWT_SEPERATOR + payload).getBytes(StandardCharsets.US_ASCII));\n        if (!URL_BASE64_ENCODER.encodeToString(bytes).equals(signature)) {\n            throw new AccessException(\"Invalid signature\");\n        }\n        NacosJwtPayload nacosJwtPayload =\n            JacksonUtils.toObj(URL_BASE64_DECODER.decode(payload), NacosJwtPayload.class);\n        if (nacosJwtPayload.getExp() >= TimeUnit.MILLISECONDS\n            .toSeconds(System.currentTimeMillis())) {\n            return new NacosUser(nacosJwtPayload.getSub());\n        }\n        \n        throw new AccessException(\"token expired!\");\n    }\n    \n    /**\n     * get jwt expire time in seconds.\n     *\n     * @param jwt complete jwt string\n     * @param key for signature\n     * @return expire time in seconds\n     * @throws AccessException access exception","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java#L116-L152","documentation":"Thrown by NacosSignatureAlgorithm.verify(header, payload, signature, key) as an AccessException when the recomputed HMAC over (header + '.' + payload) does not equal the signature carried in the token. A signature mismatch means the key used to verify differs from the key used to sign, or the token was tampered with.","triggerScenarios":"getMacInstance(key) computes the HMAC with the configured secret key; URL_BASE64_ENCODER.encodeToString(mac.doFinal(...)).equals(signature) is false, so the throw fires.","commonSituations":"token.secret.key was rotated and old clients still present tokens signed by the previous key; a multi-node cluster where nodes have different secret keys; token tampering (man-in-the-middle); wrong key configured on the verifying node.","solutions":["Ensure all Nacos server nodes share the identical token.secret.key.","After key rotation, re-issue tokens so clients carry signatures from the current key.","Confirm the secret key was not truncated/altered when deployed (compare base64 across nodes)."],"exampleFix":"// before: nodes have divergent keys\nnode-A: token.secret.key=KeyAAAA...\nnode-B: token.secret.key=KeyBBBB...\n// token signed by A fails signature check on B\n\n// after: identical key on all nodes\nnode-A: token.secret.key=SharedKey...\nnode-B: token.secret.key=SharedKey...","handlingStrategy":"try-catch","validationCode":"// Ensure the verifying key matches the signing key before issuing tokens.\nbyte[] signed = macSign(testPayload, signingKey);\nif (!MessageDigest.isEqual(signed, macSign(testPayload, verifyingKey))) {\n    throw new IllegalStateException(\"Signing and verifying keys differ\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    NacosUser user = NacosSignatureAlgorithm.verify(jwt, key);\n} catch (AccessException e) {\n    if (\"Invalid signature\".equals(e.getMessage())) {\n        // key mismatch or tampering — force client to re-login\n    }\n    throw e;\n}","preventionTips":["Keep token.secret.key identical across all Nacos nodes.","After key rotation, reissue tokens so clients carry current-key signatures.","Compare the configured key byte-for-byte across nodes to detect truncation."],"tags":["auth","jwt","security","signature"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}