OpenNHP/opennhp · error

missing y coordinate in jwk

Error message

missing y coordinate in jwk

What it means

Symmetric to the x-coordinate check: if the embedded JWK lacks 'y' or it is not a string, VerifyJWT returns 'missing y coordinate in jwk'. Both coordinates are required to reconstruct the ECDSA P-256 public key for signature verification.

Solutions

1. Add the 'y' base64url coordinate to the embedded JWK on the client side.
2. Verify the signing key is ECDSA P-256; switch client key generation if not.
3. Inspect the decoded header JWK to confirm which members are present.
4. Fix serialization code that drops fields after unmarshal/re-marshal.
5. Use a maintained signing library so the full public JWK is embedded automatically.

Example fix

// before
jwk := map[string]any{"kty":"EC","crv":"P-256","x": xB64}
// after
jwk := map[string]any{"kty":"EC","crv":"P-256","x": xB64, "y": yB64}

func jwkComplete(jwk map[string]any) bool {
	_, xok := jwk["x"].(string); _, yok := jwk["y"].(string)
	return xok && yok
}

token, err := VerifyJWT(rawToken)
if err != nil && strings.Contains(err.Error(), "missing y coordinate") {
	// incomplete JWK: return 401
}

When it happens

Trigger: jwk header contains 'x' but not 'y', or 'y' has a non-string JSON type. Reached from GetResource token verification after x passes.

Common situations: Partially hand-assembled JWK header; client only serializes x due to a bug or truncation; key material generated for a curve/key type that doesn't use y (e.g. Ed25519).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• missing x coordinate in jwk
• missing or invalid jwk in header
• invalid x coordinate
• invalid y coordinate
• JWT signing key is not initialized

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/e3ae0fac3680e3a0. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/server/kbs/resource/resource.go:232

	unverifiedToken, _, err := parser.ParseUnverified(tokenString, jwt.MapClaims{})
	if err != nil {
		return nil, fmt.Errorf("failed to parse token: %w", err)
	}

	// Extract JWK from header
	jwkHeader, ok := unverifiedToken.Header["jwk"].(map[string]any)
	if !ok {
		return nil, fmt.Errorf("missing or invalid jwk in header")
	}

	// Convert JWK back to ECDSA public key
	xStr, ok := jwkHeader["x"].(string)
	if !ok {
		return nil, fmt.Errorf("missing x coordinate in jwk")
	}
	yStr, ok := jwkHeader["y"].(string)
	if !ok {
		return nil, fmt.Errorf("missing y coordinate in jwk")
	}

	xBytes, err := base64.RawURLEncoding.DecodeString(xStr)
	if err != nil {
		return nil, fmt.Errorf("invalid x coordinate: %w", err)
	}
	yBytes, err := base64.RawURLEncoding.DecodeString(yStr)
	if err != nil {
		return nil, fmt.Errorf("invalid y coordinate: %w", err)
	}

	publicKey := &ecdsa.PublicKey{
		Curve: elliptic.P256(),
		X:     new(big.Int).SetBytes(xBytes),
		Y:     new(big.Int).SetBytes(yBytes),
	}

	// Now verify the token with the extracted public key

View on GitHub (pinned to 6e04ca5ff0)