BookStackApp/BookStack · error · OidcInvalidTokenException

Could not parse out a valid {$prop} within the provided toke

Error message

Could not parse out a valid {$prop} within the provided token

What it means

OidcJwtWithClaims::validateTokenStructure splits the JWT into header, payload, and signature parts. If the header or payload section is empty after parsing (JSON decode produced nothing usable), it throws OidcInvalidTokenException naming the missing property. This catches tokens that are not structurally valid three-part JWTs.

Source

Thrown at app/Access/Oidc/OidcJwtWithClaims.php:106

    /**
     * Replace the existing claim data of this token with that provided.
     */
    public function replaceClaims(array $claims): void
    {
        $this->payload = $claims;
    }

    /**
     * Validate the structure of the given token and ensure we have the required pieces.
     * As per https://datatracker.ietf.org/doc/html/rfc7519#section-7.2.
     *
     * @throws OidcInvalidTokenException
     */
    protected function validateTokenStructure(): void
    {
        foreach (['header', 'payload'] as $prop) {
            if (empty($this->$prop)) {
                throw new OidcInvalidTokenException("Could not parse out a valid {$prop} within the provided token");
            }
        }

        if (empty($this->signature)) {
            throw new OidcInvalidTokenException('Could not parse out a valid signature within the provided token');
        }
    }

    /**
     * Validate the signature of the given token and ensure it validates against the provided key.
     *
     * @throws OidcInvalidTokenException
     */
    protected function validateTokenSignature(): void
    {
        if ($this->header['alg'] !== 'RS256') {
            throw new OidcInvalidTokenException("Only RS256 signature validation is supported. Token reports using {$this->header['alg']}");
        }

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Verify the code passes the id_token, not an access or authorization code, into the validator
2. Check the token has three dot-separated segments before validation
3. Log the raw token (length/segments) to spot truncation by the client or proxy
4. Re-run the OIDC flow to get a fresh id_token

Example fix

// before
$jwt->validate($token);

// after
$parts = explode('.', $token);
if (count($parts) !== 3 || $parts[0] === '' || $parts[1] === '') {
    throw new \InvalidArgumentException('Malformed JWT: expected 3 non-empty segments');
}
$jwt->validate($token);

function isWellFormedJwt(string $token): bool {
    $parts = explode('.', $token);
    return count($parts) === 3
        && $parts[0] !== '' && $parts[1] !== ''
        && ($decoded = base64_decode(strtr($parts[0], '-_', '+/'), true)) !== false
        && json_decode($decoded) !== null;
}

function looksLikeJwt(mixed $token): bool { return is_string($token) && substr_count($token, '.') === 2; }

try {
    $jwt->validate($token);
} catch (\BookStack\Access\Oidc\OidcInvalidTokenException $e) {
    logger()->error('OIDC token rejected: ' . $e->getMessage());
    // abort auth flow / redirect to login with error
}

When it happens

Trigger: Calling validateCommonTokenDetails (via the OIDC validation flow) with a token string that is empty, malformed, has fewer than three dot-separated segments, or whose header/payload segments do not base64-decode into non-empty JSON.

Common situations: Truncated token sent by client; passing an opaque/access token instead of the OIDC id_token; token missing signature segment or containing extra whitespace/newlines; misconfigured callback passing the wrong request parameter.

Related errors

• Could not parse out a valid signature within the provided to
• Only RS256 signature validation is supported. Token reports
• Failed to read signing key with error:
• Token signature could not be validated using the provided ke
• Missing or non-matching token issuer value

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/869690c71220b084. Report an issue: GitHub.