{"record":{"id":"0b5f68d1d83c978c","repo":"kataras/iris","slug":"auth-configuration-headers-slice-is-empty","errorCode":null,"errorMessage":"auth: configuration: headers slice is empty","messagePattern":"auth: configuration: headers slice is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/configuration.go","lineNumber":68,"sourceCode":"\t\t// By setting the secure to true, the web browser will prevent the\n\t\t// transmission of a cookie over an unencrypted channel.\n\t\t//\n\t\t// Defaults to false but it's true when the request is under iris.Context.IsSSL().\n\t\tSecure bool `json:\"secure\" yaml:\"Secure\" toml:\"Secure\" ini:\"secure\"`\n\t\t// Hash is optional, it is used to authenticate cookie value using HMAC.\n\t\t// It is recommended to use a key with 32 or 64 bytes.\n\t\tHash string `json:\"hash\" yaml:\"Hash\" toml:\"Hash\" ini:\"hash\"`\n\t\t// Block is optional, used to encrypt cookie value.\n\t\t// The key length must correspond to the block size\n\t\t// of the encryption algorithm. For AES, used by default, valid lengths are\n\t\t// 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256.\n\t\tBlock string `json:\"block\" yaml:\"Block\" toml:\"Block\" ini:\"block\"`\n\t}\n)\n\nfunc (c *Configuration) validate() (jwt.Keys, error) {\n\tif len(c.Headers) == 0 {\n\t\treturn nil, fmt.Errorf(\"auth: configuration: headers slice is empty\")\n\t}\n\n\tif c.Cookie.Name != \"\" {\n\t\tif c.Cookie.Hash == \"\" || c.Cookie.Block == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"auth: configuration: cookie block and cookie hash are required for security reasons when cookie is used\")\n\t\t}\n\t}\n\n\tkeys, err := c.Keys.Load()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"auth: configuration: %w\", err)\n\t}\n\n\tif _, ok := keys[KIDAccess]; !ok {\n\t\treturn nil, fmt.Errorf(\"auth: configuration: %s access token is missing from the configuration\", KIDAccess)\n\t}\n\n\t// Let's keep refresh optional.","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/auth/configuration.go#L50-L86","documentation":"Configuration.validate() rejects configurations whose Headers slice is empty. The auth middleware needs at least one extraction source (request header) to look for tokens, and none was configured.","triggerScenarios":"Calling auth.New with a Configuration whose Headers field is left as a nil/empty slice — e.g. only a Cookie was configured and Headers was never populated.","commonSituations":"Copy-pasted config that deleted the default request_key header entry; building Configuration programmatically and forgetting Headers; switching from header-based to cookie-based auth without knowing Headers must remain non-empty.","solutions":["Add at least one entry to Configuration.Headers (e.g. the standard request key)","Restore the default header configuration removed by mistake","If only cookies should be used, still configure a header entry — the library requires it"],"exampleFix":"// before\nConfiguration{ Cookie: auth.Cookie{Name: \"myapp_session\", Hash: h, Block: b} }\n// after\nConfiguration{ Headers: []string{\"Authorization\"}, Cookie: auth.Cookie{Name: \"myapp_session\", Hash: h, Block: b} }","handlingStrategy":"validation","validationCode":"if len(cfg.Headers) == 0 {\n    return errors.New(\"auth configuration: at least one token extraction header is required\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always configure at least one header (e.g. \"Authorization\" or your request key)","Keep default headers when converting a YAML/TOML config from another project","Add a unit test that constructs Configuration and calls validate() at CI time","Fail fast at startup — validate() errors occur inside auth.New"],"tags":["configuration","validation","headers"],"backgroundTag":"missing-config-field","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}