When logging into APIML with an expired apiml token it throws a 400 to the user

[Joe-Winchester]

Describe the bug
Log into APIML and go home over the weekend - the apiml token expires !
Come back in on Monday and can log into the gateway and get a 400

Looking at the Zowe logs it is because the apimlAuthenticationToken JWT has expired

2026-05-11 09:18:54.723 <ZWEAGW1:reactor-http-nio-3:33557110> �[35mZWESVUSR�[0;39m �[36mDEBUG�[0;39m ((o.z.a.g.l.DeterministicLoadBalancer)) Exception when trying to parse the JWT token eyJ0eXAiOiJKV1QC.......8mugPBQh2t93LKpwFM: JWT Token is expired

I can log into a private browser and/or delete the apimlAuthenticationToken

Expected behavior
I'd like the APIML to detect the expired token and delete the cookie data and allow me to log back in again

[balhar-jakub]

Code-wise this comes from here:

    private JWTClaimsSet getJwtClaims(String jwt) {
        /*
         * Removes signature, because we don't have key to verify z/OS tokens, and we just need to read claim.
         * Verification is done by SAF itself. JWT library doesn't parse signed key without verification.
         */
        try {
            var jwtWithoutSignature = removeJwtSign(jwt);

            var claims = JWTParser.parse(jwtWithoutSignature)
                .getJWTClaimsSet();
            if (claims.getExpirationTime().toInstant().isBefore(clock.instant())) {
                throw new ExpiredJWTException("JWT Token is expired");
            }
            return claims;
        } catch (RuntimeException | ParseException | BadJWTException exception) {
            log.debug("Exception when trying to parse the JWT token {}: {}", jwt, exception.getMessage());
            return null; // NOSONAR
        }
    }

But it does not have to be the reason for the 400, actually, do you see anything else in the logs around this time?

[balhar-jakub]

Also the way the UI actually looks, is surprising, is there anything around the request in the Networking tab in the Web Developers tools?

[balhar-jakub]

Validated on the runtime - expired tokens return HTTP 401 ZWEAO402E.
The only 400 handler (handleTokenFormatException) fires on a distinct exception type unrelated to expiry.