{"record":{"id":"2db376dcb8311208","repo":"badges/shields","slug":"invalid-response-data-from-auth-endpoint","errorCode":null,"errorMessage":"invalid response data from auth endpoint","messagePattern":"invalid response data from auth endpoint","errorType":"exception","errorClass":"InvalidResponse","httpStatus":null,"severity":"error","filePath":"core/base-service/auth-helper.js","lineNumber":239,"sourceCode":" ...rest,\n }\n }\n\n withQueryStringAuth({ userKey, passKey }, requestParams) {\n return this._withAnyAuth(requestParams, requestParams =>\n this.constructor._mergeQueryParams(requestParams, {\n ...(userKey ? { [userKey]: this._user } : undefined),\n ...(passKey ? { [passKey]: this._pass } : undefined),\n }),\n )\n }\n\n static _getJwtExpiry(token, max = dayjs().add(1, 'hours').unix()) {\n // get the expiry timestamp for this JWT (capped at a max length)\n const parts = token.split('.')\n\n if (parts.length < 2) {\n throw new InvalidResponse({\n prettyMessage: 'invalid response data from auth endpoint',\n })\n }\n\n const json = validate(\n {\n ErrorClass: InvalidResponse,\n prettyErrorMessage: 'invalid response data from auth endpoint',\n },\n parseJson(Buffer.from(parts[1], 'base64').toString()),\n Joi.object({ exp: Joi.number().required() }).required(),\n )\n\n return Math.min(json.exp, max)\n }\n\n static _isJwtValid(expiry) {\n // we consider the token valid if the expiry","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/badges/shields/blob/766fd8bc89a90b8534dc573ab72dec30215ab1ec/core/base-service/auth-helper.js#L221-L257","documentation":"_getJwtExpiry splits the JWT on '.' and requires at least two segments (header.payload) to read the expiry claim. If the token does not look like a JWT, it throws InvalidResponse 'invalid response data from auth endpoint', meaning the auth endpoint returned something other than a well-formed token (capped at the `max` expiry).","triggerScenarios":"The response from the login/auth endpoint yielded a `token` value with fewer than two dot-separated segments — e.g. an HTML login page, a JSON error body passed through, an empty string, or an opaque API key mistakenly used where a JWT is expected.","commonSituations":"Auth endpoint changed its response shape after a version upgrade; wrong credentials returning an error page instead of a token; proxy/captive portal returning HTML; config pointing at the wrong login endpoint path.","solutions":["Verify the login endpoint URL is correct and returns JSON containing a real JWT","Check credentials — failed logins often return HTML/error bodies instead of tokens","Log/inspect the raw response from the auth endpoint to see what 'token' actually contains","Update the service integration if the auth API's response format changed"],"exampleFix":"// before\nconst { token } = await getAuthToken() // token = 'login page'\nconst expiry = _getJwtExpiry(token) // throws\n// after\nconst auth = await getAuthToken()\nif (typeof auth.token !== 'string' || auth.token.split('.').length < 2) throw new Error('auth endpoint did not return a JWT')\nconst expiry = _getJwtExpiry(auth.token)","handlingStrategy":"try-catch","validationCode":"function looksLikeJwt(token) {\n return typeof token === 'string' && token.trim().length > 0 && token.split('.').length >= 2 && !token.startsWith('<')\n}\nif (!looksLikeJwt(tokenFromAuthEndpoint)) throw new Error('auth endpoint did not return a JWT')","typeGuard":"function isJwt(value) {\n return typeof value === 'string' && value.split('.').length >= 2 &&\n value.split('.').every(p => p.length > 0) && !/[<\\s]/.test(value)\n}\nif (isJwt(token)) { /* safe to read expiry */ }","tryCatchPattern":"try {\n const expiry = AuthHelper._getJwtExpiry(token)\n} catch (err) {\n if (err.prettyMessage === 'invalid response data from auth endpoint') {\n // inspect raw auth response, refresh credentials or fix endpoint\n } else throw err\n}","preventionTips":["Verify the login endpoint returns JSON with a JWT-shaped token before integrating","Check HTTP status/auth credentials when a token looks like HTML or an error string","Log the raw auth response on failure for quick diagnosis","Pin and monitor the auth API version to catch response-shape changes"],"tags":["jwt","auth","invalid-response"],"backgroundTag":"jwt-token-invalid","analyzedSha":"766fd8bc89a90b8534dc573ab72dec30215ab1ec","analyzedAt":"2026-08-30T01:40:27.499Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}