{"record":{"id":"192febbc67165366","repo":"kubernetes/kops","slug":"decoding-authorization-token-w","errorCode":null,"errorMessage":"decoding authorization token: %w","messagePattern":"decoding authorization token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":154,"sourceCode":"}\n\nfunc (a awsVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {\n\tif strings.HasPrefix(token, AWSAuthenticationTokenPrefixV1) {\n\t\treturn a.verifyTokenV1(ctx, token, body, a.verifyCallerIdentity)\n\t}\n\tif strings.HasPrefix(token, AWSAuthenticationTokenPrefixV2) {\n\t\treturn a.verifyTokenV2(ctx, token, body, a.verifyCallerIdentity)\n\t}\n\n\treturn nil, bootstrap.ErrNotThisVerifier\n}\n\nfunc (a awsVerifier) verifyTokenV1(ctx context.Context, token string, body []byte, verifyCallerIdentity verifyCallerIdentityFunc) (*bootstrap.VerifyResult, error) {\n\ttoken = strings.TrimPrefix(token, AWSAuthenticationTokenPrefixV1)\n\n\ttokenBytes, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding authorization token: %w\", err)\n\t}\n\tvar decoded awsV1Token\n\tif err := json.Unmarshal(tokenBytes, &decoded); err != nil {\n\t\treturn nil, fmt.Errorf(\"unmarshalling authorization token: %w\", err)\n\t}\n\n\t// Verify the token has signed the body content.\n\tsha := sha256.Sum256(body)\n\tdecodedHeaders := http.Header(decoded)\n\n\tif decodedHeaders.Get(\"X-Kops-Request-SHA\") != base64.RawStdEncoding.EncodeToString(sha[:]) {\n\t\treturn nil, fmt.Errorf(\"incorrect SHA\")\n\t}\n\n\tauthorization := decodedHeaders.Get(\"Authorization\")\n\tif !strings.HasPrefix(authorization, \"AWS4-HMAC-SHA256 \") {\n\t\treturn nil, fmt.Errorf(\"incorrect authorization algorithm\")\n\t}","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L136-L172","documentation":"Wraps a failure of base64.StdEncoding.DecodeString in verifyTokenV1: the body of the token after the 'kOpsAwsV1' prefix is not valid base64, so the embedded headers cannot be recovered for verification.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:154 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the client sends standard base64 with padding","Check token generation in kops nodeup/bootstrap client code","Re-bootstrap the node to regenerate the token"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}