Tencent/WeKnora · error

unexpected id_token signing method: %v

Error message

unexpected id_token signing method: %v

What it means

The keyFunc callback rejects an id_token whose alg header is not an RSA signing method. Only RS256/RS384/RS512 are accepted; anything else (HS256, none, ES256) indicates a misconfigured or malicious issuer and the token is refused.

Source

Thrown at internal/application/service/user.go:1958

) (map[string]interface{}, error) {
	if strings.TrimSpace(cfg.JwksURI) == "" {
		return nil, errors.New("cannot verify OIDC id_token: no jwks_uri configured")
	}
	if strings.TrimSpace(cfg.IssuerURL) == "" {
		return nil, errors.New("cannot verify OIDC id_token: issuer is not configured")
	}
	if strings.TrimSpace(cfg.ClientID) == "" {
		return nil, errors.New("cannot verify OIDC id_token: client_id is not configured")
	}

	jwks, err := s.fetchOIDCJWKS(ctx, cfg.JwksURI)
	if err != nil {
		return nil, err
	}

	keyFunc := func(token *jwt.Token) (interface{}, error) {
		if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
			return nil, fmt.Errorf("unexpected id_token signing method: %v", token.Header["alg"])
		}
		kid, _ := token.Header["kid"].(string)
		return jwks.rsaKeyForKid(kid)
	}

	claims := jwt.MapClaims{}
	if _, err := jwt.NewParser(
		jwt.WithValidMethods([]string{"RS256", "RS384", "RS512"}),
		jwt.WithExpirationRequired(),
		jwt.WithLeeway(oidcIDTokenLeeway),
		jwt.WithIssuer(strings.TrimSpace(cfg.IssuerURL)),
		jwt.WithAudience(strings.TrimSpace(cfg.ClientID)),
	).ParseWithClaims(idToken, claims, keyFunc); err != nil {
		return nil, fmt.Errorf("id_token verification failed: %w", err)
	}
	verified := map[string]interface{}(claims)
	if strings.TrimSpace(extractClaimAsString(verified, "sub")) == "" {
		return nil, errors.New("id_token missing sub claim")

View on GitHub (pinned to 988cbb0330)

Solutions

1. Configure the IdP to sign id_tokens with RS256/RS384/RS512
2. Confirm the OIDC client config targets the right issuer
3. Never weaken the algorithm allowlist to accept the offered alg

When it happens

Trigger: Thrown at internal/application/service/user.go:1958 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/e3f51707b35833f9. Report an issue: GitHub.