{"record":{"id":"0c06f267d040a21c","repo":"kgretzky/evilginx2","slug":"auth-tokens-domain-not-found-for-http-auth-toke","errorCode":null,"errorMessage":"auth_tokens: 'domain' not found for http auth token","messagePattern":"auth_tokens: 'domain' not found for http auth token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":565,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'search' not found for body auth token\")\n\t\t\t}\n\n\t\t\terr := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"http\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Header == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'header' not found for http auth token\")\n\t\t\t}\n\n\t\t\terr := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tfor _, au := range fp.AuthUrls {","sourceCodeStart":547,"sourceCodeEnd":583,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L547-L583","documentation":"Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'domain' field. HTTP header auth tokens need domain, path, name, and header; domain is required to scope which host the token applies to. The phishlet fails to load.","triggerScenarios":"A phishlet YAML defines auth_tokens entry with type: http but omits 'domain', or the key is misspelled/indented outside the entry.","commonSituations":"Writing a header-token phishlet from scratch and forgetting domain; copying a body-token template (where domain may look optional to the author); YAML tab/space indentation errors detaching the key.","solutions":["Add a 'domain:' field (e.g. '.example.com') to the http auth_tokens entry","Check indentation so 'domain' belongs to the same list item as 'type: http'","Compare against a working example phishlet's http token structure"],"exampleFix":"// before\nauth_tokens:\n  - type: http\n    path: '/api'\n    name: Authorization\n    header: Authorization\n// after\nauth_tokens:\n  - type: http\n    domain: '.example.com'\n    path: '/api'\n    name: Authorization\n    header: Authorization","handlingStrategy":"validation","validationCode":"for i, at := range cfg.AuthTokens {\n  if at.Type == \"http\" && (at.Domain == nil || *at.Domain == \"\") {\n    return fmt.Errorf(\"auth_tokens[%d]: http token missing 'domain'\", i)\n  }\n}","typeGuard":"func hasDomain(at AuthToken) bool { return at.Domain != nil && *at.Domain != \"\" }","tryCatchPattern":null,"preventionTips":["Mirror all four required http fields (domain, path, name, header) from a working example","Lint YAML indentation to prevent detached keys","Validate phishlets in CI before distribution"],"tags":["phishlet","config","yaml","validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}