go auth_error ai_generated true

rpc error: code = PermissionDenied desc = invalid auth token

ID: go/grpc-permission-denied-auth-token

Also available as: JSON · Markdown · 中文
80%Fix Rate
85%Confidence
0Evidence
2024-07-12First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.56.x active — — —
1.57.x active — — —

Root Cause

The authentication token provided in the gRPC metadata is invalid or expired.

generic

中文

gRPC 元数据中提供的身份验证令牌无效或已过期。

Workarounds

  1. 90% success 
    token, err := refreshToken(); if err != nil { log.Fatal(err) }; md := metadata.Pairs("authorization", "Bearer "+token)
  2. 85% success 
    interceptor := func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error { token := getValidToken(); ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+token); return invoker(ctx, method, req, reply, cc, opts...) }
  3. 95% success 
    if token.Expiry.Before(time.Now()) { token, err = refreshToken() }

Dead Ends

Common approaches that don't work:

  1. Continuing to use the same expired token. 100% fail

    Token is still invalid.

  2. Using a static test token in production. 80% fail

    Security risk and may not be valid in production.

  3. Removing the token from metadata. 90% fail

    Server requires authentication.