{"record":{"id":"2f43f2487ac5646b","repo":"wavetermdev/waveterm","slug":"error-extracting-socket-name-from-jwt-v","errorCode":null,"errorMessage":"error extracting socket name from JWT: %v","messagePattern":"error extracting socket name from JWT: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/wsh/cmd/wshcmd-connserver.go","lineNumber":294,"sourceCode":"\t// run the sysinfo loop\n\tgo func() {\n\t\tdefer func() {\n\t\t\tpanichandler.PanicHandler(\"serverRunRouter:RunSysInfoLoop\", recover())\n\t\t}()\n\t\twshremote.RunSysInfoLoop(client, connServerConnName)\n\t}()\n\tstartJobLogCleanup()\n\tlog.Printf(\"running server, successfully started\")\n\tselect {}\n}\n\nfunc serverRunRouterDomainSocket(jwtToken string) error {\n\tlog.Printf(\"starting connserver router (domain socket upstream)\")\n\n\t// extract socket name from JWT token (unverified - we're on the client side)\n\tsockName, err := wshutil.ExtractUnverifiedSocketName(jwtToken)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error extracting socket name from JWT: %v\", err)\n\t}\n\n\t// connect to the forwarded domain socket\n\tsockName = wavebase.ExpandHomeDirSafe(sockName)\n\tconn, err := net.Dial(\"unix\", sockName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error connecting to domain socket %s: %v\", sockName, err)\n\t}\n\n\t// create router\n\trouter := wshutil.NewWshRouter()\n\tConnServerWshRouter = router\n\n\t// create proxy for the domain socket connection\n\tupstreamProxy := wshutil.MakeRpcProxy(\"connserver-upstream\")\n\n\t// goroutine to write to the domain socket\n\tgo func() {","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/cmd/wsh/cmd/wshcmd-connserver.go#L276-L312","documentation":"serverRunRouterDomainSocket extracts the upstream socket name embedded in the JWT token using wshutil.ExtractUnverifiedSocketName (unverified, client-side). This error is wrapped when the token is missing, malformed, or lacks the socket-name claim. It indicates the JWT passed to `wsh connserver` is not a valid connection token produced by the Wave server.","triggerScenarios":"Calling serverRunRouterDomainSocket with a jwtToken whose payload does not contain the expected socket-name claim, or that fails base64/JSON parsing of the unverified claims section.","commonSituations":"Passing an arbitrary/stale environment variable instead of the token Wave injects (e.g. WAVETERM_CLIENTJWT variants); token truncated by shell quoting; using a token from a different Wave version with a changed claim name; hand-constructing the JWT.","solutions":["Re-obtain the JWT from the Wave terminal environment (restart `wsh` from inside a Wave block) rather than reusing a stored value.","Check the token is a complete 3-part JWT and not truncated (echo \"$WAVETERM_CONNSERVER_JWT\" style).","Inspect the unverified payload (echo <token> | cut -d. -f2 | base64 -d) to confirm the socket-name claim exists.","Ensure wsh and server versions match so the claim name is the expected one."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func looksLikeJwt(tok string) bool {\n\tparts := strings.Split(tok, \".\")\n\tif len(parts) != 3 { return false }\n\tfor _, p := range parts {\n\t\tif _, err := base64.RawURLEncoding.DecodeString(p); err != nil { return false }\n\t}\n\treturn true\n}\n// call before serverRunRouterDomainSocket:\nif !looksLikeJwt(jwtToken) { return errors.New(\"malformed jwt token\") }","typeGuard":"func hasSocketNameClaim(tok string) bool {\n\tparts := strings.Split(tok, \".\")\n\tif len(parts) != 3 { return false }\n\traw, err := base64.RawURLEncoding.DecodeString(parts[1])\n\tif err != nil { return false }\n\tvar claims map[string]any\n\tif json.Unmarshal(raw, &claims) != nil { return false }\n\t_, ok := claims[\"socketname\"]\n\treturn ok\n}","tryCatchPattern":"sockName, err := wshutil.ExtractUnverifiedSocketName(jwtToken)\nif err != nil {\n\treturn fmt.Errorf(\"error extracting socket name from JWT: %w\", err)\n}","preventionTips":["Always take the JWT from the live Wave terminal environment, not stored copies.","Validate JWT structure (3 dot-separated base64 parts) before use.","Avoid shell pipelines that might truncate the token (quote variables).","Keep wsh and server versions aligned so claim names match."],"tags":["jwt","validation","unix-socket","wsh"],"backgroundTag":"jwt-token-invalid","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}