goharbor/harbor · error

failed to refresh token, username: %s, error: %v

Error message

failed to refresh token, username: %s, error: %v

What it means

Error "failed to refresh token, username: %s, error: %v" thrown in goharbor/harbor.

Source

Thrown at src/pkg/oidc/secret.go:120

		return nil, fmt.Errorf("failed to decrypt secret from DB: %v", err)
	}
	if subtle.ConstantTimeCompare([]byte(secret), []byte(plainSecret)) != 1 {
		return nil, verifyError(fmt.Errorf("secret mismatch, username: %s", username))
	}
	tokenStr, err := utils.ReversibleDecrypt(oidcUser.Token, key)
	if err != nil {
		return nil, verifyError(err)
	}
	token := &Token{}
	err = json.Unmarshal(([]byte)(tokenStr), token)
	if err != nil {
		return nil, verifyError(err)
	}
	if !token.Valid() {
		log.Debug("Refreshing token")
		token, err = refreshToken(ctx, token)
		if err != nil {
			return nil, fmt.Errorf("failed to refresh token, username: %s, error: %v", username, err)
		}
		tb, err := json.Marshal(token)
		if err != nil {
			return nil, fmt.Errorf("failed to encode the refreshed token, error: %v", err)
		}
		encToken, _ := utils.ReversibleEncrypt(string(tb), key)
		oidcUser.Token = encToken
		// only updates the token column of the record
		err = dm.metaDao.Update(ctx, oidcUser, "token")
		if err != nil {
			log.Errorf("Failed to persist token, user id: %d, error: %v", oidcUser.UserID, err)
		}
		log.Debug("Token refreshed and persisted")
	}
	info, err := UserInfoFromToken(ctx, token)
	if err != nil {
		return nil, verifyError(err)
	}

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/pkg/oidc/secret.go:120 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/4304be3c4813b1b8. Report an issue: GitHub.