{"record":{"id":"2bf2b99484a7a010","repo":"kataras/iris","slug":"auth-refresh-disabled","errorCode":null,"errorMessage":"auth: refresh: disabled","messagePattern":"auth: refresh: disabled","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth.go","lineNumber":476,"sourceCode":"func (s *Auth[T]) ExtractAccessToken(ctx *context.Context) string {\n\t// first try from authorization: bearer header.\n\taccessToken := s.extractTokenFromHeader(ctx)\n\n\t// then if no header, try try extract from cookie.\n\tif accessToken == \"\" {\n\t\tif cookieName := s.config.Cookie.Name; cookieName != \"\" {\n\t\t\taccessToken = ctx.GetCookie(cookieName, context.CookieEncoding(s.securecookie))\n\t\t}\n\t}\n\n\treturn accessToken\n}\n\n// Refresh accepts a previously generated refresh token (from SigninHandler) and\n// returns a new access and refresh token pair.\nfunc (s *Auth[T]) Refresh(ctx stdContext.Context, refreshToken []byte) ([]byte, []byte, error) {\n\tif !s.refreshEnabled {\n\t\treturn nil, nil, fmt.Errorf(\"auth: refresh: disabled\")\n\t}\n\n\tt, _, err := s.verify(ctx, refreshToken)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"auth: refresh: %w\", err)\n\t}\n\n\t// refresh the tokens, both refresh & access tokens will be renew to prevent\n\t// malicious 😈 users that may hold a refresh token.\n\taccessTok, refreshTok, err := s.sign(t)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"auth: refresh: %w\", err)\n\t}\n\n\treturn accessTok, refreshTok, nil\n}\n\n// RefreshHandler reads the request body which should include data for `RefreshRequest` structure","sourceCodeStart":458,"sourceCodeEnd":494,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/auth/auth.go#L458-L494","documentation":"Auth.Refresh was called but refresh-token support is disabled. Refresh is only enabled when the configuration's Keys contain a KIDRefresh entry; otherwise the method refuses to rotate tokens.","triggerScenarios":"Calling Auth.Refresh (via RefreshHandler) when New was constructed with a Keys map lacking the KIDRefresh entry, so s.refreshEnabled is false.","commonSituations":"An endpoint wired to RefreshHandler but the deployment config never added a refresh key; a client still posting old refresh tokens after refresh support was removed from the server config.","solutions":["Add a KIDRefresh key to the Configuration.Keys map so refresh tokens are enabled","Or remove/disable the RefreshHandler route if refresh tokens are not wanted","Inform clients that refresh flow is not available in this deployment"],"exampleFix":"// before\nKeys: map[string]jwt.Key{ \"access\": accessSecret }\n// after\nKeys: map[string]jwt.Key{ \"access\": accessSecret, \"refresh\": refreshSecret }","handlingStrategy":"validation","validationCode":"// before wiring RefreshHandler, ensure refresh is enabled in this deployment:\nif _, ok := cfg.Keys[auth.KIDRefresh]; !ok {\n    return fmt.Errorf(\"RefreshHandler mounted but %s key not configured\", auth.KIDRefresh)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only mount RefreshHandler when a KIDRefresh key is configured","Add a startup assertion that refresh config matches mounted routes","Document per-environment whether refresh tokens are enabled","Return a clear 404/501 to clients when refresh is disabled"],"tags":["jwt","refresh-token","configuration"],"backgroundTag":"jwt-refresh-disabled","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}