{"record":{"id":"2b76c14ea5e57945","repo":"Tencent/WeKnora","slug":"id-token-verification-failed-w","errorCode":null,"errorMessage":"id_token verification failed: %w","messagePattern":"id_token verification failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1972,"sourceCode":"\t}\n\n\tkeyFunc := func(token *jwt.Token) (interface{}, error) {\n\t\tif _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {\n\t\t\treturn nil, fmt.Errorf(\"unexpected id_token signing method: %v\", token.Header[\"alg\"])\n\t\t}\n\t\tkid, _ := token.Header[\"kid\"].(string)\n\t\treturn jwks.rsaKeyForKid(kid)\n\t}\n\n\tclaims := jwt.MapClaims{}\n\tif _, err := jwt.NewParser(\n\t\tjwt.WithValidMethods([]string{\"RS256\", \"RS384\", \"RS512\"}),\n\t\tjwt.WithExpirationRequired(),\n\t\tjwt.WithLeeway(oidcIDTokenLeeway),\n\t\tjwt.WithIssuer(strings.TrimSpace(cfg.IssuerURL)),\n\t\tjwt.WithAudience(strings.TrimSpace(cfg.ClientID)),\n\t).ParseWithClaims(idToken, claims, keyFunc); err != nil {\n\t\treturn nil, fmt.Errorf(\"id_token verification failed: %w\", err)\n\t}\n\tverified := map[string]interface{}(claims)\n\tif strings.TrimSpace(extractClaimAsString(verified, \"sub\")) == \"\" {\n\t\treturn nil, errors.New(\"id_token missing sub claim\")\n\t}\n\treturn verified, nil\n}\n\nfunc extractClaimAsString(claims map[string]interface{}, key string) string {\n\tkey = strings.TrimSpace(key)\n\tif key == \"\" {\n\t\treturn \"\"\n\t}\n\tvalue, ok := claims[key]\n\tif !ok || value == nil {\n\t\treturn \"\"\n\t}\n\tswitch v := value.(type) {","sourceCodeStart":1954,"sourceCodeEnd":1990,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1954-L1990","documentation":"Wrapper around the jwt parser failure when verifying an OIDC id_token. The wrapped cause covers expired tokens, wrong issuer/audience, unknown kid, bad signature, or missing expiration. Login via OIDC fails for this token only.","triggerScenarios":"Thrown at internal/application/service/user.go:1972 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Read the wrapped cause: expiry vs issuer/audience vs signature","Ensure the IdP's clock and leeway settings align (oidcIDTokenLeeway)","Verify client_id and issuer_url match the token's aud/iss claims","Refresh the JWKS cache if keys were rotated"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}