{"record":{"id":"0c7cc7b9192a4b04","repo":"netbirdio/netbird","slug":"invalid-token-data","errorCode":null,"errorMessage":"invalid token data","messagePattern":"invalid token data","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/relay/auth/hmac/v2/token.go","lineNumber":25,"sourceCode":"\tSignature []byte\n\tPayload   []byte\n}\n\nfunc (t *Token) Marshal() []byte {\n\tsize := 1 + len(t.Signature) + len(t.Payload)\n\n\tbuf := make([]byte, size)\n\n\tbuf[0] = byte(t.AuthAlgo)\n\tcopy(buf[1:], t.Signature)\n\tcopy(buf[1+len(t.Signature):], t.Payload)\n\n\treturn buf\n}\n\nfunc UnmarshalToken(data []byte) (*Token, error) {\n\tif len(data) == 0 {\n\t\treturn nil, errors.New(\"invalid token data\")\n\t}\n\n\talgo := AuthAlgo(data[0])\n\tsigSize := algo.Size()\n\tif len(data) < 1+sigSize {\n\t\treturn nil, errors.New(\"invalid token data: insufficient length\")\n\t}\n\n\treturn &Token{\n\t\tAuthAlgo:  algo,\n\t\tSignature: data[1 : 1+sigSize],\n\t\tPayload:   data[1+sigSize:],\n\t}, nil\n}\n","sourceCodeStart":7,"sourceCodeEnd":40,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/shared/relay/auth/hmac/v2/token.go#L7-L40","documentation":"UnmarshalToken rejects a zero-length buffer. The relay HMAC token wire format is at least one algorithm-identifier byte plus a signature, so empty input cannot be a token at all. It usually means the caller passed no token bytes — a client that failed to obtain or attach its management-issued relay auth token.","triggerScenarios":"Validator.Validate receiving an auth payload of length 0; a relay connection whose first frame carries no token; client code passing a nil slice after a failed token fetch.","commonSituations":"Token plumbing broken between management and agent; agent older than the relay version that mandates auth; self-hosted relay deployed with auth requirements the client does not fulfill.","solutions":["Ensure the client obtains and stores a relay auth token from management before connecting","Check that the bytes handed to Validate are the complete token frame, not the result of an empty read","Align management, relay, and agent versions so tokens are issued and consumed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(tokenBytes) == 0 {\n\treturn fmt.Errorf(\"no relay auth token available; obtain one from management before connecting\")\n}\nif err := validator.Validate(tokenBytes); err != nil {\n\treturn err\n}","typeGuard":null,"tryCatchPattern":"if err := validator.Validate(data); err != nil {\n\tif err.Error() == \"invalid token data\" {\n\t\t// deny: the client attached no token; do not retry with the same bytes\n\t}\n\treturn err\n}","preventionTips":["Treat an empty token as a hard stop, never as a retryable condition","Fetch and persist the relay token immediately after login","Log token length (not contents) when auth fails to distinguish empty from malformed"],"tags":["relay","auth","hmac","token"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}