affaan-m/ECC · warning · ErrUnauthorized

unauthorized

Error message

unauthorized

What it means

A Go sentinel error ErrUnauthorized = errors.New("unauthorized") from the golang-patterns skill, listed alongside ErrNotFound and ErrInvalidInput as one of the common-case domain sentinels. It is matched with errors.Is and wrapped with context where the failure occurs.

Source

Thrown at skills/golang-patterns/SKILL.md:131

```

### Custom Error Types

```go
// Define domain-specific errors
type ValidationError struct {
    Field   string
    Message string
}

func (e *ValidationError) Error() string {
    return fmt.Sprintf("validation failed on %s: %s", e.Field, e.Message)
}

// Sentinel errors for common cases
var (
    ErrNotFound     = errors.New("resource not found")
    ErrUnauthorized = errors.New("unauthorized")
    ErrInvalidInput = errors.New("invalid input")
)
```

### Error Checking with errors.Is and errors.As

```go
func HandleError(err error) {
    // Check for specific error
    if errors.Is(err, sql.ErrNoRows) {
        log.Println("No records found")
        return
    }

    // Check for error type
    var validationErr *ValidationError
    if errors.As(err, &validationErr) {
        log.Printf("Validation error on field %s: %s",

View on GitHub (pinned to 01e15490f0)

Solutions

1. Verify the Authorization header exists and is well-formed before invoking the service.
2. Refresh short-lived tokens before they expire to avoid the unauthorized path entirely.
3. At the handler, map errors.Is(err, ErrUnauthorized) to 401 for missing/invalid creds and use a separate sentinel for 403 forbidden.
4. Log the specific cause server-side but return a generic message to avoid information leakage.

Example fix

// before
var ErrUnauthorized = errors.New("unauthorized")

// after: separate authentication from authorization
var (
    ErrUnauthenticated = errors.New("unauthenticated")
    ErrForbidden       = errors.New("forbidden")
)

// verify credentials before reaching the protected service
if !auth.HasValidToken(r) {
    http.Error(w, "unauthorized", http.StatusUnauthorized)
    return
}

null

null

When it happens

Trigger: An auth middleware or service returns/wraps ErrUnauthorized when credentials are missing, invalid, or insufficient. Subsequent layers wrap it with fmt.Errorf("...: %w", ErrUnauthorized) to add context without losing the sentinel identity.

Common situations: JWT signature verification fails; token expired; missing Authorization header; user role below the required level; API key revoked.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• unauthorized
• email cannot be empty
• not found
• resource not found
• user %s: %w

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/f3f030a6c36b4fd2. Report an issue: GitHub.