> For the complete documentation index, see [llms.txt](https://www.axisnow.io/zh/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.axisnow.io/zh/docs/edge/policies/authn-authz/faq.md).
# 常见问题
认证与授权的常见疑问与排错
## 排错
返回 401 和 403 分别是什么问题？
401 Unauthorized 是认证失败，403 Forbidden 是认证通过但授权规则拒绝了这个身份。具体原因看访问日志的 `extras.authn_authz.reason` 和 `message`，见[工作原理 › 日志字段](/zh/docs/edge/policies/authn-authz/how-it-works.md#log-fields)。
带了 JWT 仍然返回 401 Unauthorized
先用认证方式的集成测试粘贴这个令牌，结果里有失败原因。常见的是：`Authorization` 头的值没有 `Bearer` 前缀（按未携带凭据处理）；令牌头部的 `alg` 与认证方式配置的算法不一致；令牌的 `kid` 不在 JWKS 里。规则见[工作原理 › JWT](/zh/docs/edge/policies/authn-authz/how-it-works.md#jwt)。
轮换了签名密钥，新令牌被拒绝
边缘的 JWKS 缓存还没刷新，新 `kid` 找不到。按[最佳实践](/zh/docs/edge/policies/authn-authz.md#best-practices)的顺序先发布再使用；直接填写公钥的，新旧公钥并列填入。
JWKS 地址不可达会怎样？
缓存有效期内不受影响，到期后拉取失败时继续用缓存的结果。边缘重启后缓存为空，请求要等拉取超时（连接 30 秒，重试 3 次）后才返回 401 Unauthorized，日志 `reason` 为 `dependency`；这类失败不计入认证失败封禁。
正常用户被认证失败封禁误封
多半是客户端令牌过期后自动重试触发了封禁，处理见[最佳实践](/zh/docs/edge/policies/authn-authz.md#best-practices)；封禁到期自动解除，没有手动解封。
## 行为
会给请求增加多少延迟？
JWT 验签在边缘本地完成，自定义函数只依据当前请求判断、不发起外部请求，两者都在毫秒以内；每条请求的实际耗时记在日志字段 `time_us`。例外是 JWKS 缓存到期或边缘重启后的首次拉取，见上文。
认证与授权和通用访问控制、速率控制是什么关系？
三个插件按不同维度过滤，认证与授权在最前：按身份决定是谁、能不能进，通用访问控制按请求特征，速率控制按频率。认证失败的请求不进入后两者，认证通过的请求是否进入由[附加控制](/zh/docs/edge/policies/authn-authz/how-it-works.md#controls)决定。
自定义认证能做到什么程度？
函数只能读取当前请求并用运行时内置的 crypto、jwt、regex 等模块校验，不能发起网络请求，有指令预算上限，适合鉴权这类轻量逻辑。可用的 API 和限制见[边缘运行时](/zh/docs/edge/policies/edge-runtime.md)。
浏览器跨域调用接口，预检请求要不要放行？
不用，`OPTIONS` 预检请求不做认证直接放行，正常请求再校验凭据。
边缘会把认证通过的身份传给源站吗？
不会。边缘只做前置拦截，源站收到的请求和客户端发来的一样，源站按原样校验凭据。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://www.axisnow.io/zh/docs/edge/policies/authn-authz/faq.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.