Skip to content

fix(console): redirect to login page on token invalid/expired responses#14856

Merged
KomachiSion merged 1 commit into
alibaba:developfrom
Sunrisea:fix/console-session-expired-redirect
Apr 7, 2026
Merged

fix(console): redirect to login page on token invalid/expired responses#14856
KomachiSion merged 1 commit into
alibaba:developfrom
Sunrisea:fix/console-session-expired-redirect

Conversation

@Sunrisea

@Sunrisea Sunrisea commented Apr 4, 2026

Copy link
Copy Markdown
Contributor

What is the purpose of the change

When the JWT token becomes invalid (e.g. after changing nacos.core.auth.plugin.nacos.token.secret.key and restarting), the backend returns HTTP 403 with {code: 10001, message: "access denied", data: "Code: 401, Message: Invalid signature."}. However, both the legacy and next console UIs fail to detect this as a session expiration and do not redirect to the login page.

Root Cause

  1. Legacy UI (console-ui/src/utils/request.js): The error interceptor only checked the message field with strict equality against a small list (token invalid!, token expired!, etc.). The actual error message "access denied" didn't match, and the data field (which contains "Invalid signature") was never checked.

  2. Next UI (console-ui-next/src/api/client.ts): The error interceptor checked both message and data fields, but the keyword list was missing "invalid signature" and other token-related error messages from the backend.

  3. Both UIs: The success interceptor had no session expiration detection at all, which is needed as a defensive measure in case the HTTP status code is not correctly set to 403.

Brief changelog

  • Expanded the session expired detection keyword list to cover all token/identity-related 403 error messages from the backend, including: invalid signature, expired token, unsupported signature algorithm, user not found, token is required, token is empty, token has expired, token signature verification failed
  • Legacy UI: Changed error interceptor to check both message and data.data fields using case-insensitive includes() matching (previously used strict equality on message only); extracted the keyword list into a shared constant
  • Next UI: Added missing keywords to SESSION_EXPIRED_MESSAGES constant
  • Both UIs: Added session expiration detection in the success (HTTP 200) response interceptor to handle cases where the business error code indicates auth failure
  • Added auto-copy of build artifacts to the legacy UI npm run build script (consistent with next UI)

How to verify

  1. Start Nacos server with auth enabled
  2. Login to the console (legacy or next)
  3. Change nacos.core.auth.plugin.nacos.token.secret.key in the config and restart the server
  4. Perform any operation in the console (e.g. navigate to a page that triggers an API call)
  5. Verify the console automatically redirects to the login page instead of showing a generic error

Follow this checklist to help us incorporate your contribution quickly and easily:

  • Make sure there is a Github issue filed for the change (usually before you start working on it). Trivial changes like typos do not require a Github issue. Your pull request should address just this issue, without pulling in other changes - one PR resolves one issue.
  • Format the pull request title like [ISSUE #123] Fix UnknownException when host config not exist. Each commit in the pull request should have a meaningful subject line and body.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Write necessary unit-test to verify your logic correction, more mock a little better when cross module dependency exist. If the new feature or significant change is committed, please remember to add integration-test in test module.
  • Run mvn -B clean package apache-rat:check spotbugs:check -DskipTests to make sure basic checks pass. Run mvn clean install -DskipITs to make sure unit-test pass. Run mvn clean test-compile failsafe:integration-test to make sure integration-test pass.

Improve session expired detection in both legacy and next console UIs:

- Add 'invalid signature' and other token-related error messages to
  session expired detection list
- Check both 'message' and 'data' fields in error responses (the server
  wraps the real reason inside the 'data' field via AuthResult.format())
- Add session expired detection in success interceptor for cases where
  HTTP 200 is returned with business error code
- Extract session expired messages into a shared constant in legacy UI
- Add auto-copy of build artifacts to legacy UI build script

Assisted-by: Kiro
@github-actions

github-actions Bot commented Apr 4, 2026

Copy link
Copy Markdown

Thanks for your this PR. 🙏
Please check again for your PR changes whether contains any usage/api/configuration change such as Add new API , Add new configuration, Change default value of configuration.
If so, please add or update documents(markdown type) in docs/next/ for repository nacos-group/nacos-group.github.io


感谢您提交的PR。 🙏
请再次查看您的PR内容,确认是否包含任何使用方式/API/配置参数的变更,如:新增API新增配置参数修改默认配置等操作。
如果是,请确保在提交之前,在仓库nacos-group/nacos-group.github.io中的docs/next/目录下添加或更新文档(markdown格式)。

@KomachiSion
KomachiSion merged commit 1154aed into alibaba:develop Apr 7, 2026
2 checks passed
@KomachiSion KomachiSion added this to the 3.2.1 milestone Apr 7, 2026
@KomachiSion KomachiSion added the area/Nacos console Related to Nacos consle label Apr 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/Nacos console Related to Nacos consle

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants