paascloud/paascloud-master · error · ZuulException

刷新页面重试

Error message

刷新页面重试

What it means

AuthHeaderFilter.doSomething (a Zuul pre-filter) requires an Authorization header on requests it considers auth-related; RequestUtil.getAuthHeader(request) returned empty, so it throws ZuulException('刷新页面重试', 403, 'check token fail'). Note the guard uses OR (!contains) logic, so the filter only proceeds when the URI matches AUTH_PATH and none of LOGOUT_URI/ALIPAY_CALL_URI appear — the 403 means the client reached such a route without carrying a token header.

Solutions

1. Ensure the frontend attaches 'Authorization: Bearer <token>' to all gateway auth-path requests (check request interceptors)
2. Log in again to obtain a fresh token — the previous one may have expired or been cleared on refresh
3. Verify no intermediary (Nginx, Spring Cloud Gateway, CORS preflight handling) strips the Authorization header
4. If the endpoint should be public, adjust the filter's path guard so the URI is excluded from the auth check

Example fix

// before: fetch without token header
fetch('/api/auth/user');
// after: attach bearer token
fetch('/api/auth/user', {
  headers: { Authorization: 'Bearer ' + localStorage.getItem('token') }
});

const token = localStorage.getItem('token');
if (!token) {
  router.push('/login');
} else {
  fetch(url, { headers: { Authorization: 'Bearer ' + token } });
}

try {
  const res = await fetch(authUrl, { headers: { Authorization: 'Bearer ' + token } });
  if (res.status === 403) {
    // header missing/rejected — re-authenticate
    redirectToLogin();
  }
} catch (e) { redirectToLogin(); }

When it happens

Trigger: Calling any gateway route whose URI contains AUTH_PATH (and not the logout/alipay-callback paths) via a non-OPTIONS method without an Authorization header — e.g. a browser page refresh after the frontend dropped its stored token, or a direct API call without the header.

Common situations: Frontend lost/expired its access token in localStorage and refreshes a protected page; calling gateway auth endpoints directly (curl/Postman) without setting Authorization; a proxy or BFF stripping the Authorization header; frontend routing sends requests through the gateway that should bypass it.

Related errors

• 设备id参数不能为空
• 请在请求头中携带deviceId参数

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/8eec3bb2939774a9. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-gateway/src/main/java/com/paascloud/gateway/filter/AuthHeaderFilter.java:102

			doSomething(requestContext);
		} catch (Exception e) {
			log.error("AuthHeaderFilter - [FAIL] EXCEPTION={}", e.getMessage(), e);
			throw new BusinessException(ErrorCodeEnum.UAC10011041);
		}
		return null;
	}

	private void doSomething(RequestContext requestContext) throws ZuulException {
		HttpServletRequest request = requestContext.getRequest();
		String requestURI = request.getRequestURI();

		if (OPTIONS.equalsIgnoreCase(request.getMethod()) || !requestURI.contains(AUTH_PATH) || !requestURI.contains(LOGOUT_URI) || !requestURI.contains(ALIPAY_CALL_URI)) {
			return;
		}
		String authHeader = RequestUtil.getAuthHeader(request);

		if (PublicUtil.isEmpty(authHeader)) {
			throw new ZuulException("刷新页面重试", 403, "check token fail");
		}

		if (authHeader.startsWith(BEARER_TOKEN_TYPE)) {
			requestContext.addZuulRequestHeader(HttpHeaders.AUTHORIZATION, authHeader);

			log.info("authHeader={} ", authHeader);
			// 传递给后续微服务
			requestContext.addZuulRequestHeader(CoreHeaderInterceptor.HEADER_LABEL, authHeader);
		}
	}

}

View on GitHub (pinned to 781281a950)