AlistGo/alist · error

oidc: malformed jwt payload: %v

Error message

oidc: malformed jwt payload: %v

What it means

Returned by parseJWT (server/handles/ssologin.go:182) when the second dot-separated segment of the id_token cannot be decoded with base64.RawURLEncoding. The payload segment must be unpadded URL-safe base64; standard base64 with '+' or '/' characters, padded '==' output, or any corruption (truncation, character substitution) fails here.

Source

Thrown at server/handles/ssologin.go:182

			user.Username = user.Username + "_" + userID
			if err = db.CreateUser(user); err != nil {
				return nil, err
			}
		} else {
			return nil, err
		}
	}
	return user, nil
}

func parseJWT(p string) ([]byte, error) {
	parts := strings.Split(p, ".")
	if len(parts) < 2 {
		return nil, fmt.Errorf("oidc: malformed jwt, expected 3 parts got %d", len(parts))
	}
	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
	if err != nil {
		return nil, fmt.Errorf("oidc: malformed jwt payload: %v", err)
	}
	return payload, nil
}

func OIDCLoginCallback(c *gin.Context) {
	useCompatibility := setting.GetBool(conf.SSOCompatibilityMode)
	method := c.Query("method")
	if useCompatibility {
		method = path.Base(c.Request.URL.Path)
	}
	clientId := setting.GetStr(conf.SSOClientId)
	endpoint := setting.GetStr(conf.SSOEndpointName)
	provider, err := oidc.NewProvider(c, endpoint)
	if err != nil {
		common.ErrorResp(c, err, 400)
		return
	}
	oauth2Config, err := GetOIDCClient(c, useCompatibility, "", method)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Confirm the token reaches the server byte-identical (log lengths at both ends)
2. Re-encode the payload with base64.RawURLEncoding if you mint tokens yourself
3. If the provider emits padded tokens, fetch a fresh token — do not hand-edit segments

Example fix

// before (minting)
seg := base64.StdEncoding.EncodeToString(payload) // may contain + / =
// after
seg := base64.RawURLEncoding.EncodeToString(payload)

func validRawURLBase64(seg string) bool {
  _, err := base64.RawURLEncoding.DecodeString(seg)
  return err == nil
}

When it happens

Trigger: A JWT whose payload was re-encoded by an intermediary (proxy, logging framework) that escaped or padded it; a token pasted or truncated mid-segment; providers emitting padded base64 in the payload.

Common situations: Tokens passed through systems that URL-decode and re-encode them; copy-paste of tokens losing characters; custom JWT minting that uses StdEncoding instead of RawURLEncoding.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• oidc: malformed jwt, expected 3 parts got %d
• failed to decode jwt token
• cannot get username from SSO provider
• failed to refresh token: sub not match
• not a jwt token because of invalid segments

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/f1e214fda8e874de. Report an issue: GitHub.