Nonce failed issue

[buger]

Tell me all the possible reasons when I can get this kind of error, and steps how to simulate eahc of it

•	Policy request login failure ... Authorization failed (Nonce empty)

[probelabs]

Hello @buger, thank you for opening this issue.

From your report, I understand you're encountering a Policy request login failure ... Authorization failed (Nonce empty) error and are looking for potential causes and ways to reproduce it.

Based on my analysis of the Tyk Gateway codebase, this error is related to the security mechanism used for communication between a Tyk Gateway node and the Tyk Dashboard. The gateway uses a "nonce" (a number used once) to sign its requests to the Dashboard, which the Dashboard then validates.

Potential Causes

A "Nonce failed" or "Nonce empty" error typically occurs when there's a synchronization issue between the Gateway and the Dashboard. Here are the most likely scenarios:

1. Gateway-Dashboard Registration Failure: The gateway may not be properly registered with the Dashboard. When a gateway starts, it registers itself and receives an initial nonce. If this process fails due to network issues or incorrect Dashboard credentials in the gateway's configuration, subsequent requests to fetch policies will fail.

2. Nonce Desynchronization: The nonce is updated with each successful communication. If a request from the gateway fails for some reason (e.g., a temporary network blip), but the Dashboard has already updated its expected nonce, the gateway's next request will be rejected. The gateway has a built-in recovery mechanism for this, but if it fails repeatedly, it will lead to this error.

3. Multiple Gateways with the Same Identity: If you have multiple gateway nodes that are misconfigured to share the same node ID while communicating with the Dashboard, they will constantly invalidate each other's nonces.

4. Dashboard Restart: If the Tyk Dashboard is restarted, it might lose the current nonce state for connected gateways, especially if it's using in-memory storage for sessions. When the gateway tries to communicate with its old nonce, the Dashboard will reject it.

How to Simulate

Here are some ways you could try to reproduce these scenarios:

• Simulate Registration Failure:

  1. Start a Tyk Gateway configured to use a Dashboard for its policy source.
  2. Block the network traffic from the Gateway to the Dashboard's API endpoint (e.g., using iptables or a firewall rule).
  3. Attempt to make an API call through the gateway that requires a policy. The gateway will fail to fetch policies and you should see nonce-related errors in the logs.

• Simulate Nonce Desynchronization:

  1. With a running Gateway and Dashboard, manually make a request to the Dashboard's API endpoint that gateways use for communication (e.g., for heartbeats), using the gateway's credentials and node ID but an incorrect nonce.
  2. This might cause the Dashboard to invalidate the real gateway's nonce.
  3. The gateway's next heartbeat or policy update should then fail.

• Simulate Dashboard Restart:

  1. Have a gateway connected to a Dashboard.
  2. Make a successful API call through the gateway.
  3. Restart the Tyk Dashboard process.
  4. Wait for the gateway's next heartbeat interval. You should see the gateway attempting to re-register due to nonce failure. If the re-registration fails for any reason, you will see persistent errors.

To help us investigate further, could you provide more context about when this error occurs? Specifically:

• Are there any other related error messages in your gateway logs around the same time?
• Does this happen intermittently or consistently?
• Did this start happening after a change, like a gateway/dashboard restart or a configuration update?

This information will be very helpful for diagnosing the root cause.

References

gateway/dashboard_recovery.go#isNonceRelatedError - Shows how the gateway identifies nonce-related errors from the Dashboard.
gateway/dashboard_recovery.go#executeDashboardRequestWithRecovery - Contains the core logic for handling and recovering from nonce failures.

value_js evaluation failed: sandbox_runner_error: error is not defined

---

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>