amir20/dozzle · error

err.Error()

Error message

err.Error()

What it means

createToken authenticates a user (typically LDAP/simple backend validation) and issues a JWT; when token creation fails (invalid credentials or internal signing error), the raw error is returned with 401 Unauthorized.

Solutions

1. Verify the username/password (check users.yml or the auth provider)
2. Check Dozzle debug logs for 'Failed to create token' with the underlying error
3. If signing errors: verify the JWT secret configuration and restart Dozzle
4. Re-test login after fixing credentials; clear stale cookies first

if (!username || !password) throw new Error('credentials required before requesting a token');

const res = await fetch('/api/token', {method: 'POST', body: creds});
if (res.status === 401) {
  const msg = await res.text();
  throw new Error(`login failed: ${msg}`); // prompt user to re-enter credentials
}

When it happens

Trigger: POST to the token endpoint with wrong username/password, a user that the auth backend cannot validate, or an internal failure generating the JWT (bad secret).

Common situations: Typos in users.yml credentials; user forgetting password after config change; LDAP unavailable; shared secret misconfigured so signing fails.

Related errors

• Unauthorized
• user has an invalid filter
• username is required
• Bad Request
• Forbidden

AI-assisted analysis of amir20/dozzle@d9463cbe21 (2026-09-07). Data as JSON: /api/errors/cc323cf4877f94a6. Report an issue: GitHub.

Appendix: source

Thrown at internal/web/auth.go:35

		if h.config.Authorization.TTL > 0 {
			expires = time.Now().Add(h.config.Authorization.TTL)
		}

		http.SetCookie(w, &http.Cookie{
			Name:     "jwt",
			Value:    token,
			HttpOnly: true,
			Path:     "/",
			SameSite: http.SameSiteLaxMode,
			Secure:   isHTTPS(r),
			Expires:  expires,
		})
		log.Info().Str("user", user).Msg("Token created")
		w.WriteHeader(http.StatusOK)
		w.Write([]byte(http.StatusText(http.StatusOK)))
	} else {
		log.Error().Err(err).Msg("Failed to create token")
		http.Error(w, err.Error(), http.StatusUnauthorized)
	}
}

func (h *handler) deleteToken(w http.ResponseWriter, r *http.Request) {
	http.SetCookie(w, &http.Cookie{
		Name:     "jwt",
		Value:    "",
		HttpOnly: true,
		Path:     "/",
		SameSite: http.SameSiteLaxMode,
		Secure:   isHTTPS(r),
		Expires:  time.Unix(0, 0),
	})
	w.WriteHeader(http.StatusOK)
	w.Write([]byte(http.StatusText(http.StatusOK)))
}

// isHTTPS reports whether the original client request used HTTPS, accounting

View on GitHub (pinned to d9463cbe21)