{"record":{"id":"14640f89552bd510","repo":"kubernetes/kops","slug":"decoding-authorization-token-v","errorCode":null,"errorMessage":"decoding authorization token: %v","messagePattern":"decoding authorization token: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":218,"sourceCode":"\t}\n\tif amzCredential == \"\" {\n\t\treturn nil, fmt.Errorf(\"unexpected credential value\")\n\t}\n\n\tcallerIdentity, err := a.stsRequestValidator.getCallerIdentityV1(ctx, &a.client, decoded)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn verifyCallerIdentity(ctx, callerIdentity)\n}\n\nfunc (a awsVerifier) verifyTokenV2(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {\n\ttoken = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV2)\n\n\ttokenBytes, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding authorization token: %v\", err)\n\t}\n\tvar decoded awsV2Token\n\tif err := json.Unmarshal(tokenBytes, &decoded); err != nil {\n\t\treturn nil, fmt.Errorf(\"unmarshalling authorization token: %v\", err)\n\t}\n\n\t// Verify the token has signed the body content.\n\tsha := sha256.Sum256(body)\n\tif decoded.SignedHeader.Get(\"X-Kops-Request-SHA\") != base64.RawStdEncoding.EncodeToString(sha[:]) {\n\t\treturn nil, fmt.Errorf(\"incorrect SHA\")\n\t}\n\n\treqURL, err := url.Parse(decoded.URL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing STS request URL: %v\", err)\n\t}\n\tsignedHeaders := sets.New(strings.Split(reqURL.Query().Get(\"X-Amz-SignedHeaders\"), \";\")...)\n\tif !signedHeaders.Has(\"x-kops-request-sha\") {","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L200-L236","documentation":"The node's bootstrap token (v2 format) could not be base64-decoded after stripping the AWS token prefix: the token bytes are not valid StdEncoding base64, typically because the token was truncated, re-encoded, or prefixed twice.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:218 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the token is passed through unmodified (no shell/env truncation or duplicated prefixes)","Confirm both sides use base64 StdEncoding and the same AWSAuthenticationTokenPrefixV2","Regenerate the token on the node if it was corrupted in transit"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}