{"record":{"id":"101f1826a189c925","repo":"dgraph-io/dgraph","slug":"unsupported-signing-algorithm-v","errorCode":null,"errorMessage":"unsupported signing algorithm: %v","messagePattern":"unsupported signing algorithm: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"x/acl_enc_keys.go","lineNumber":126,"sourceCode":"\t\t}\n\t\treturn pk, &pk.PublicKey, nil\n\n\tcase strings.HasPrefix(alg.Alg(), \"RS\") || strings.HasPrefix(alg.Alg(), \"PS\"):\n\t\tpk, err := jwt.ParseRSAPrivateKeyFromPEM(key)\n\t\tif err != nil {\n\t\t\treturn nil, nil, errors.Wrapf(err, \"error parsing ACL key as RSA private key\")\n\t\t}\n\t\treturn pk, &pk.PublicKey, nil\n\n\tcase alg.Alg() == \"EdDSA\":\n\t\tpk, err := jwt.ParseEdPrivateKeyFromPEM(key)\n\t\tif err != nil {\n\t\t\treturn nil, nil, errors.Wrapf(err, \"error parsing ACL key as EdDSA private key\")\n\t\t}\n\t\treturn pk.(crypto.Signer), pk.(ed25519.PrivateKey).Public(), nil\n\n\tdefault:\n\t\treturn nil, nil, errors.Errorf(\"unsupported signing algorithm: %v\", alg.Alg())\n\t}\n}\n\nfunc checkAclKeyLength(alg jwt.SigningMethod, key Sensitive) error {\n\tif !strings.HasPrefix(alg.Alg(), \"HS\") {\n\t\treturn nil\n\t}\n\n\tsl, err := strconv.Atoi(strings.TrimPrefix(alg.Alg(), \"HS\"))\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"error finding sha length for algo %v\", alg.Alg())\n\t}\n\n\t// SHA length has to be smaller or equal to the key length\n\tif sl > len(key)*8 {\n\t\treturn errors.Errorf(\"ACL key length [%v <= %v] bits for JWT algorithm [%v]\", len(key)*8, sl, alg.Alg())\n\t}\n\treturn nil","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/x/acl_enc_keys.go#L108-L144","documentation":"parseJWTKey switches on the algorithm prefix (HS/ES/RS|PS/EdDSA). If the resolved jwt.SigningMethod falls into none of these branches, it returns this error as a final safety net for algorithms the ACL path does not support.","triggerScenarios":"GetEncAclKeys resolving a signing method whose Alg() is none of the handled prefixes — possible with nonstandard or future algorithms returned by jwt.GetSigningMethod (e.g. custom registered methods or 'none').","commonSituations":"Rare in practice; occurs when a custom jwt.SigningMethod was registered globally or an unusual alg string resolves to an unexpected method.","solutions":["Use a standard supported algorithm: HS256/384/512, ES256/384/512, RS256/384/512, PS*, or EdDSA","Remove any custom jwt.SigningMethod registrations that could be picked up","Inspect alg.Alg() in the message to identify the offending algorithm"],"exampleFix":"// before\n--acl \"...;jwt-alg=none\"\n// after\n--acl \"...;jwt-alg=HS256\"","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"HS256\":true,\"HS384\":true,\"HS512\":true,\"RS256\":true,\"RS384\":true,\"RS512\":true,\"ES256\":true,\"ES384\":true,\"ES512\":true,\"EdDSA\":true}\nif !allowed[algStr] { return fmt.Errorf(\"alg %q not supported for ACL\", algStr) }","typeGuard":null,"tryCatchPattern":"if _, err := x.GetEncAclKeys(flag, encKey); err != nil {\n    if strings.Contains(err.Error(), \"unsupported signing algorithm\") {\n        log.Fatalf(\"use a standard HS/ES/RS/PS/EdDSA algorithm\")\n    }\n    return err\n}","preventionTips":["Restrict jwt-alg configuration to a known-good whitelist","Avoid registering custom jwt.SigningMethod globally in the same process","Review the resolved alg name in the error message"],"tags":["jwt","acl","crypto","unsupported"],"backgroundTag":"unsupported-jwt-algorithm","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}