prestodb/presto · error · ChallengeFailedException

no valid expiration date

Error message

no valid expiration date

What it means

NimbusOAuth2Client.determineExpiration found neither a computed valid-until instant nor an exp claim in the token, so there is no way to know when the token expires and authentication fails (ChallengeFailedException) rather than treating the token as non-expiring.

Source

Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/NimbusOAuth2Client.java:658

        }
    }

    private static Instant determineExpiration(Optional<Instant> validUntil, Date expiration)
            throws ChallengeFailedException
    {
        if (validUntil.isPresent()) {
            if (expiration != null) {
                return Ordering.natural().min(validUntil.get(), expiration.toInstant());
            }

            return validUntil.get();
        }

        if (expiration != null) {
            return expiration.toInstant();
        }

        throw new ChallengeFailedException("no valid expiration date");
    }

    private Optional<String> buildRefreshToken(RefreshToken refreshToken, Optional<String> existingRefreshToken)
    {
        Optional<String> firstOption = Optional.ofNullable(refreshToken)
                .map(RefreshToken::getValue);

        if (firstOption.isPresent()) {
            return firstOption;
        }
        else if (existingRefreshToken.isPresent()) {
            return existingRefreshToken;
        }
        else {
            return Optional.empty();
        }
    }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Ensure the identity provider issues tokens with an exp claim
2. Configure a token expiration/refresh window so a validUntil can be derived

When it happens

Trigger: Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/NimbusOAuth2Client.java:658 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/c42c9dce3808388c. Report an issue: GitHub.