halo-dev/halo · error · InvalidCookieException

Cookie token[1] has expired (expired on '{}'; current time i

Error message

Cookie token[1] has expired (expired on '{}'; current time is '{}')

What it means

Error "Cookie token[1] has expired (expired on '{}'; current time is '{}')" thrown in halo-dev/halo.

Source

Thrown at application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java:145

        } else if (ex instanceof RememberMeAuthenticationException) {
            log.debug(ex.getMessage());
        }
        return Mono.empty();
    }

    protected void cancelCookie(ServerWebExchange exchange) {
        rememberMeCookieResolver.expireCookie(exchange);
    }

    protected Mono<UserDetails> processAutoLoginCookie(String[] cookieTokens, ServerWebExchange exchange) {
        if (!isValidCookieTokensLength(cookieTokens)) {
            throw new InvalidCookieException(
                    "Cookie token did not contain 3 or 4 tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
        }

        long tokenExpiryTime = getTokenExpiryTime(cookieTokens);
        if (isTokenExpired(tokenExpiryTime)) {
            throw new InvalidCookieException("Cookie token[1] has expired (expired on '" + new Date(tokenExpiryTime)
                    + "'; current time is '" + new Date() + "')");
        }

        // Check the user exists. Defer lookup until after expiry time checked, to
        // possibly avoid expensive database call.
        return getUserDetailsService()
                .findByUsername(cookieTokens[0])
                .switchIfEmpty(Mono.error(new UsernameNotFoundException("User '" + cookieTokens[0] + "' not found")))
                .flatMap(userDetails -> {
                    // Check signature of token matches remaining details. Must do this after user
                    // lookup, as we need the DAO-derived password. If efficiency was a major issue,
                    // just add in a UserCache implementation, but recall that this method is usually
                    // only called once per HttpSession - if the token is valid, it will cause
                    // SecurityContextHolder population, whilst if invalid, will cause the cookie to
                    // be cancelled.
                    String actualTokenSignature;
                    String actualAlgorithm = DEFAULT_ALGORITHM;
                    // If the cookie value contains the algorithm, we use that algorithm to check the

View on GitHub (pinned to d2f5165f9c)

Solutions

1. Log in again; the remember-me token has passed its expiry time.
2. If tokens expire too quickly, increase the remember-me token validity in the security configuration.
3. Check the server clock for drift, since expiry is compared against the server's current time.

When it happens

Trigger: Thrown at application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java:145 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/2848c95f8d44dfe2. Report an issue: GitHub.