Tencent/WeKnora · error

missing expiration

Error message

missing expiration

What it means

Ad-hoc error created in verifyExternalUserJWT when claims.GetExpirationTime() returns nil or errors — the external user JWT carries no exp claim. The parser is configured with jwt.WithExpirationRequired(), and this check is the fallback ensuring an expiration actually exists before the token is accepted.

Source

Thrown at internal/middleware/auth.go:640

		jwt.WithAudience("weknora"),
		jwt.WithExpirationRequired(),
		jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
	)
	token, err := parser.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
		}
		return []byte(secret), nil
	})
	if err != nil {
		return "", err
	}
	if token == nil || !token.Valid {
		return "", errors.New("invalid external user token")
	}
	exp, err := claims.GetExpirationTime()
	if err != nil || exp == nil {
		return "", errors.New("missing expiration")
	}
	if time.Until(exp.Time) > maxExternalUserTokenTTL {
		return "", fmt.Errorf("token lifetime exceeds %s", maxExternalUserTokenTTL)
	}
	if nbf, nbfErr := claims.GetNotBefore(); nbfErr == nil && nbf != nil && time.Now().Before(nbf.Time) {
		return "", errors.New("token not yet valid")
	}
	if got := principalTenantIDFromClaims(claims); got != tenantID {
		return "", fmt.Errorf("workspace mismatch: got %d want %d", got, tenantID)
	}
	sub, _ := claims["sub"].(string)
	sub = strings.TrimSpace(sub)
	if sub == "" {
		return "", errors.New("missing subject")
	}
	return sub, nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Token issuer must include an exp claim in the external user JWT
2. Use a JWT library setting that always emits exp
3. Reject and re-issue the token; tokens without expiry are unsafe for this auth mode

When it happens

Trigger: Thrown at internal/middleware/auth.go:640 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/92062c5707b6c2dc. Report an issue: GitHub.