{"record":{"id":"2abe258a108827b4","repo":"gofr-dev/gofr","slug":"modulus-is-empty","errorCode":null,"errorMessage":"modulus is empty","messagePattern":"modulus is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/oauth.go","lineNumber":24,"sourceCode":"\t\"encoding/base64\"\n\t\"encoding/json\"\n\t\"errors\"\n\t\"fmt\"\n\t\"io\"\n\t\"math/big\"\n\t\"net/http\"\n\t\"regexp\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/golang-jwt/jwt/v5\"\n)\n\nvar (\n\terrEmptyProvider       = errors.New(\"require non-empty provider\")\n\terrInvalidInterval     = errors.New(\"invalid interval, require a value greater than 1 second\")\n\terrEmptyModulus        = errors.New(\"modulus is empty\")\n\terrEmptyPublicExponent = errors.New(\"public exponent is empty\")\n\terrEmptyResponseBody   = errors.New(\"response body is empty\")\n\terrInvalidURL          = errors.New(\"invalid URL\")\n)\n\nconst jwtRegexPattern = \"^[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+$\"\n\n// PublicKeys stores a map of public keys identified by their key ID (kid).\ntype PublicKeys struct {\n\tmu   sync.RWMutex\n\tkeys map[string]*rsa.PublicKey\n}\n\n// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).\ntype JWKNotFound struct {\n}\n\nfunc (JWKNotFound) Error() string {","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/oauth.go#L6-L42","documentation":"errEmptyModulus is returned by rsaPublicKey in GoFr's OAuth middleware when a JSON Web Key (JWK) has an empty or missing 'n' (modulus) field. RSA public keys reconstructed from a JWKS endpoint require both the modulus and the exponent; without the modulus the key cannot be built for JWT signature verification.","triggerScenarios":"Parsing a JWKS response where a key entry lacks the n field, the JWKS endpoint returns malformed/partial keys, or the base64url decoding yields an empty modulus value.","commonSituations":"Identity provider misconfiguration or a JWKS URL pointing at the wrong endpoint, proxy stripping the response body, or a key type mismatch (e.g. EC keys) whose fields don't map to RSA modulus/exponent.","solutions":["Verify the JWKS endpoint returns valid RSA keys including both n and kty:\"RSA\" fields","Check you're fetching the correct JWKS URL for your issuer","Validate the JWK fields (modulus/exponent present, non-empty) before constructing the public key","Handle the error by failing the token verification with 401 and logging the raw JWKS response for diagnosis"],"exampleFix":"// before\nkey, err := middleware.RSAPublicKey(jwk) // jwk.N == \"\" -> errEmptyModulus\n// after\nif jwk.N == \"\" || jwk.E == \"\" {\n    return nil, fmt.Errorf(\"invalid JWK for kid %q: missing modulus/exponent\", jwk.Kid)\n}\nkey, err := middleware.RSAPublicKey(jwk)","handlingStrategy":"type-guard","validationCode":"func validRSAJwk(k Jwk) bool {\n    return k.Kty == \"RSA\" && k.N != \"\" && k.E != \"\"\n}","typeGuard":"func hasModulus(k Jwk) bool { return k.N != \"\" }","tryCatchPattern":"key, err := rsaPublicKey(jwk)\nif err != nil {\n    if errors.Is(err, middleware.ErrEmptyModulus) {\n        log.Errorf(\"JWK kid=%q has no modulus; JWKS endpoint or key type wrong\", jwk.Kid)\n        return nil, errors.New(\"token verification unavailable\")\n    }\n    return nil, err\n}","preventionTips":["Validate JWKS entries (kty=RSA, n and e present) right after fetching","Pin and monitor your identity provider's JWKS URL","Log the raw JWKS response when key construction fails","Filter out non-RSA keys before attempting RSA key construction"],"tags":["oauth","jwt","jwks","rsa","gofr"],"backgroundTag":"invalid-jwk-key","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}