AlistGo/alist · error · ErrSignInvalid

sign invalid

Error message

sign invalid

What it means

ErrSignInvalid from HMACSign.Verify: the expiry parsed fine and is not past, but recomputing HMAC-SHA256(secret, data+":"+expire) base64url does not match the supplied signature. Either the data, the secret, or the signature was altered.

Source

Thrown at pkg/sign/sign.go:12

package sign

import "errors"

type Sign interface {
	Sign(data string, expire int64) string
	Verify(data, sign string) error
}

var (
	ErrSignExpired   = errors.New("sign expired")
	ErrSignInvalid   = errors.New("sign invalid")
	ErrExpireInvalid = errors.New("expire invalid")
	ErrExpireMissing = errors.New("expire missing")
)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Use the signed URL exactly as issued — do not modify the path or query between signing and verification
2. Persist the signing secret (set it explicitly) so restarts do not invalidate outstanding links
3. Regenerate the sign for the new data via Sign(data, expire) if the data legitimately changed

Example fix

// before
url := signedURL
url.Path = "/other/file.mp4" // tampered -> ErrSignInvalid

// after
// request a new sign for the intended path
sign := signer.Sign("/other/file.mp4", time.Now().Add(time.Hour).Unix())

func hasValidShape(s string) bool {
	parts := strings.Split(s, ":")
	return len(parts) == 2 && parts[0] != "" && parts[1] != ""
}

err := signer.Verify(data, signStr)
if errors.Is(err, sign.ErrSignInvalid) {
	return fmt.Errorf("signature mismatch for %q: URL modified or secret changed", data)
}

When it happens

Trigger: Calling Verify(data, sign) where the URL path (data) was modified after signing, the server's secret key changed (restarted with new JWT/sign secret), or the sign string was truncated/mangled.

Common situations: User edits the signed URL (changes path or filename); alist redeploys with a different token-sign secret so previously issued links all fail; proxy rewrites or decodes the path differently than at signing time.

Related errors

• sign expired
• baidu youth sk is empty
• oss: chunkNum invalid
• clientID and clientSecret are required in client_credentials
• share_ids is required

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/fd5289b7e87b2d6b. Report an issue: GitHub.