{"record":{"id":"0e7802f03031a284","repo":"Tencent/WeKnora","slug":"missing-external-user-token","errorCode":null,"errorMessage":"missing external user token","messagePattern":"missing external user token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/middleware/auth.go","lineNumber":615,"sourceCode":"\t\t\treturn types.Principal{}, fmt.Errorf(\"%w: %w\", errInvalidExternalUserToken, err)\n\t\t}\n\t\tif err := validateExternalUserID(externalUserID); err != nil {\n\t\t\treturn types.Principal{}, fmt.Errorf(\"%w: %v\", errInvalidExternalUserID, err)\n\t\t}\n\t\treturn types.Principal{\n\t\t\tType: types.PrincipalAPIExternalUser,\n\t\t\tID:   strconv.FormatUint(tenantID, 10) + \":\" + externalUserID,\n\t\t}, nil\n\tdefault:\n\t\treturn fallback, nil\n\t}\n}\n\nfunc verifyExternalUserJWT(tokenString string, tenantID uint64, secret string) (string, error) {\n\ttokenString = strings.TrimSpace(tokenString)\n\tsecret = strings.TrimSpace(secret)\n\tif tokenString == \"\" {\n\t\treturn \"\", errors.New(\"missing external user token\")\n\t}\n\tif secret == \"\" {\n\t\treturn \"\", errors.New(\"external user token secret is not configured\")\n\t}\n\tclaims := jwt.MapClaims{}\n\tparser := jwt.NewParser(\n\t\tjwt.WithAudience(\"weknora\"),\n\t\tjwt.WithExpirationRequired(),\n\t\tjwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),\n\t)\n\ttoken, err := parser.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {\n\t\tif _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {\n\t\t\treturn nil, fmt.Errorf(\"unexpected signing method: %v\", token.Header[\"alg\"])\n\t\t}\n\t\treturn []byte(secret), nil\n\t})\n\tif err != nil {\n\t\treturn \"\", err","sourceCodeStart":597,"sourceCodeEnd":633,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/middleware/auth.go#L597-L633","documentation":"Ad-hoc error created in verifyExternalUserJWT (called from resolveAPIPrincipal) when the X-External-User-Token header value is empty after trimming. It is an input guard: no token was supplied, so JWT parsing is skipped entirely.","triggerScenarios":"Thrown at internal/middleware/auth.go:615 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Client must provide the X-External-User-Token header alongside X-External-User-ID","If tokens are optional for this deployment, adjust the auth mode so the fallback principal applies","Trim whitespace client-side; an all-whitespace header counts as missing"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}