Pumpkin-MC/Pumpkin · error · LoginError

Failed to decode extra using decode_b64_url_nopad.

Error message

Failed to decode extra using decode_b64_url_nopad.

What it means

LoginError variant raised when the base64 URL-encoded 'ExtraData' section of the Bedrock login token chain fails to decode with decode_b64_url_nopad, meaning the client's identity payload is corrupt or truncated.

Solutions

1. Reject the login with an invalid-token kick message
2. Log the decode error at debug level
3. Check that the token uses unpadded base64url encoding

When it happens

Trigger: Thrown at crates/pumpkin/src/net/bedrock/login/mod.rs:44 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/d4ab00f52ea756b7. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin/src/net/bedrock/login/mod.rs:44

use thiserror::Error;
use tracing::debug;
use uuid::Uuid;

#[derive(Debug, Error)]
pub enum LoginError {
    #[error("Login packet data is not valid JSON")]
    InvalidTokenFormat(#[from] serde_json::Error),
    #[error("JWT chain validation failed: {0}")]
    ChainValidationFailed(#[from] AuthError),
    #[error("The validated username is invalid")]
    InvalidUsername,
    #[error("Could not parse UUID from validated token")]
    InvalidUuid,
    #[error("Cannot accept self-signed token. Authentication is enforced by server config.")]
    SelfSignedNotAllowed,
    #[error("Got a guest/splitscreen login request. Currently unimplemented.")]
    GuestUnimplemented,
    #[error("Failed to decode extra using decode_b64_url_nopad.")]
    DecodeExtraError,
}

#[derive(Deserialize_repr)]
#[repr(u8)]
enum AuthenticationType {
    Full,
    Guest,
    SelfSigned,
}

#[derive(Deserialize)]
#[serde(rename_all = "PascalCase")]
struct AuthPayload {
    authentication_type: AuthenticationType,
    token: String,
}

View on GitHub (pinned to 8d4639e25a)