{"record":{"id":"379965a698f40388","repo":"VictoriaMetrics/VictoriaMetrics","slug":"failed-to-create-es-verifier-for-algorithm-s-w-379965","errorCode":null,"errorMessage":"failed to create ES verifier for algorithm %s: %w","messagePattern":"failed to create ES verifier for algorithm (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/jwt/verifier_pool.go","lineNumber":75,"sourceCode":"\t\t\t\t\treturn nil, fmt.Errorf(\"failed to create RSA-PSS verifier for algorithm %s: %w\", alg, err)\n\t\t\t\t}\n\t\t\t\tvs = append(vs, &verifier{\n\t\t\t\t\tVerifier: v,\n\n\t\t\t\t\tkey: k,\n\t\t\t\t\talg: alg,\n\t\t\t\t})\n\t\t\t}\n\n\t\tcase *ecdsa.PublicKey:\n\t\t\talg := getAlgorithmForKey(k)\n\t\t\tif alg == \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create ECDSA verifier: unsupported key\")\n\t\t\t}\n\n\t\t\tv, err := newVerifierES(alg, k)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create ES verifier for algorithm %s: %w\", alg, err)\n\t\t\t}\n\t\t\tvs = append(vs, &verifier{\n\t\t\t\tVerifier: v,\n\n\t\t\t\tkey: k,\n\t\t\t\talg: string(alg),\n\t\t\t})\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"unknown key type: %T\", key)\n\t\t}\n\t}\n\n\treturn &VerifierPool{\n\t\tvs: vs,\n\t}, nil\n}\n\n// Verify verifies a token signature by using keys provided to verifier pool","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/jwt/verifier_pool.go#L57-L93","documentation":"After mapping an ECDSA key's curve to an ES algorithm, NewVerifierPool calls newVerifierES to instantiate the verifier. If that constructor fails, pool creation is aborted with this wrapped error naming the algorithm.","triggerScenarios":"newVerifierES failing for an ECDSA key whose curve was recognized (P-256/P-384/P-521) but whose parameters are inconsistent or rejected by the underlying ES verifier constructor.","commonSituations":"Corrupted or partially deserialized ECDSA keys; keys with mismatched curve/point data; library-internal constraint checks in the ES verifier failing for edge-case keys.","solutions":["Inspect the wrapped inner error for the concrete reason from newVerifierES.","Re-load or re-serialize the ECDSA key to ensure x/y coordinates match the declared curve.","Validate the key with key.Validate() before passing it to NewVerifierPool."],"exampleFix":"// before\npool, err := jwt.NewVerifierPool([]crypto.PublicKey{maybeBrokenKey})\n// after\nif err := maybeBrokenKey.Validate(); err != nil {\n    return fmt.Errorf(\"invalid ecdsa key: %w\", err)\n}\npool, err := jwt.NewVerifierPool([]crypto.PublicKey{maybeBrokenKey})","handlingStrategy":"validation","validationCode":"if err := ecKey.Validate(); err != nil {\n\treturn fmt.Errorf(\"invalid ECDSA key: %w\", err)\n}","typeGuard":"ek, ok := key.(*ecdsa.PublicKey); if !ok { /* not an EC key */ }","tryCatchPattern":"pool, err := jwt.NewVerifierPool(keys)\nif err != nil {\n\treturn fmt.Errorf(\"ES verifier setup: %w\", err)\n}","preventionTips":["Call ecdsa.PublicKey.Validate() before constructing verifiers.","Ensure x/y coordinates are decoded from the same curve as declared in the JWK.","Re-serialize keys from source data if deserialization errors are suspected."],"tags":["jwt","ecdsa","key-validation","crypto"],"backgroundTag":"jwt-verifier-creation-failed","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}