Tencent/WeKnora · error

invalid user ID in token

Error message

invalid user ID in token

What it means

Raised in RefreshToken when the JWT claims map lacks a string user_id — the refresh token parsed and signed correctly but its payload is malformed or was minted without the expected claim. Auth-flow guard; treat as an invalid token.

Source

Thrown at internal/application/service/user.go:1341

	})

	if err != nil || !token.Valid {
		return "", "", errors.New("invalid refresh token")
	}

	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok {
		return "", "", errors.New("invalid token claims")
	}

	tokenType, ok := claims["type"].(string)
	if !ok || tokenType != "refresh" {
		return "", "", errors.New("not a refresh token")
	}

	userID, ok := claims["user_id"].(string)
	if !ok {
		return "", "", errors.New("invalid user ID in token")
	}

	// Check if token is revoked
	tokenRecord, err := s.tokenRepo.GetTokenByValue(ctx, refreshTokenString)
	if err != nil || tokenRecord == nil || tokenRecord.IsRevoked {
		return "", "", errors.New("refresh token is revoked")
	}
	if tokenRecord.TokenType != "refresh_token" {
		return "", "", errors.New("not a refresh token")
	}

	// Get user
	user, err := s.userRepo.GetUserByID(ctx, userID)
	if err != nil {
		return "", "", err
	}

	// Revoke old refresh token

View on GitHub (pinned to 988cbb0330)

Solutions

1. Reject the token (401) and force a fresh login
2. Check token-issuing code so refresh tokens always carry user_id

When it happens

Trigger: Thrown at internal/application/service/user.go:1341 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/002fcb8b2c4a51b0. Report an issue: GitHub.