flipped-aurora/gin-vue-admin · error

token尚未激活

Error message

token尚未激活

What it means

TokenNotValidYet is returned by ParseToken when the token's nbf (not-before) claim is later than the current time. The token is structurally valid but is being used before its activation window opens.

Source

Thrown at server/utils/jwt.go:20

import (
	"context"
	"errors"
	"time"

	"github.com/flipped-aurora/gin-vue-admin/server/global"
	"github.com/flipped-aurora/gin-vue-admin/server/model/system/request"
	jwt "github.com/golang-jwt/jwt/v5"
)

type JWT struct {
	SigningKey []byte
}

var (
	TokenValid            = errors.New("未知错误")
	TokenExpired          = errors.New("token已过期")
	TokenNotValidYet      = errors.New("token尚未激活")
	TokenMalformed        = errors.New("这不是一个token")
	TokenSignatureInvalid = errors.New("无效签名")
	TokenInvalid          = errors.New("无法处理此token")
)

func NewJWT() *JWT {
	return &JWT{
		[]byte(global.GVA_CONFIG.JWT.SigningKey),
	}
}

func (j *JWT) CreateClaims(baseClaims request.BaseClaims) request.CustomClaims {
	bf, _ := ParseDuration(global.GVA_CONFIG.JWT.BufferTime)
	ep, _ := ParseDuration(global.GVA_CONFIG.JWT.ExpiresTime)
	claims := request.CustomClaims{
		BaseClaims: baseClaims,
		BufferTime: int64(bf / time.Second), // 缓冲时间1天 缓冲时间内会获得新的token刷新令牌 此时一个用户会存在两个有效令牌 但是前端只留一个 另一个会丢失
		RegisteredClaims: jwt.RegisteredClaims{

View on GitHub (pinned to 3136500ef3)

Solutions

  1. Sync clocks on both issuing and validating machines (chrony/NTP).
  2. Re-issue a token without a future nbf if immediate use is intended.
  3. If pre-issued (future-nbf) tokens are intentional, delay client use until after nbf.

Example fix

// before
jwtClaims := ... // token minted with future nbf on skewed host
claims, err := utils.ParseToken(token) // token尚未激活
// after
// ntpdate / chronyc makestep  -> clocks aligned
// re-issue token with nbf <= now
claims, err := utils.ParseToken(token) // ok
Defensive patterns

Strategy: try-catch

Validate before calling

if payload["nbf"] && payload["nbf"]*1000 > Date.now() {
    return errors.New("token not active yet; check clocks or issue time")
}

Try / catch

claims, err := utils.ParseToken(token)
if errors.Is(err, utils.TokenNotValidYet) {
    // clock skew likely: alert ops to sync NTP; do not accept the token early
    return nil, ErrTokenNotActive
}

Prevention

When it happens

Trigger: A token issued with a future nbf/iat is presented immediately; server clock is behind the issuing server's clock, so a token issued 'now' by machine A looks not-yet-valid on machine B.

Common situations: Clock skew between issuing and validating servers or between a token minted on a machine with a fast clock; pre-issued tokens with an intentional future nbf used too early; containers with wrong timezone/UTC offsets.

Related errors

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/061b6721f983c820. Report an issue: GitHub.