{"record":{"id":"39039ca30a143a38","repo":"dgraph-io/dgraph","slug":"invalid-jwt-algorithm-found-s-but-supported-opt","errorCode":null,"errorMessage":"invalid jwt algorithm: found %s, but supported options are: %s","messagePattern":"invalid jwt algorithm: found (.+?), but supported options are: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/authorization/auth.go","lineNumber":541,"sourceCode":"\treturn time.Now().After(a.expiryTime[i])\n}\n\n// initSigningMethod takes the current Algo value, validates it's a supported SigningMethod, then sets the SigningMethod\n// field.\nfunc (a *AuthMeta) initSigningMethod() error {\n\t// configurations using JWK URLs do not use signing methods.\n\tif len(a.JWKUrls) != 0 || a.JWKUrl != \"\" {\n\t\treturn nil\n\t}\n\n\tsigningMethod, ok := supportedAlgorithms[a.Algo]\n\tif !ok {\n\t\tarr := make([]string, 0, len(supportedAlgorithms))\n\t\tfor k := range supportedAlgorithms {\n\t\t\tarr = append(arr, k)\n\t\t}\n\n\t\treturn errors.Errorf(\n\t\t\t\"invalid jwt algorithm: found %s, but supported options are: %s\",\n\t\t\ta.Algo, strings.Join(arr, \",\"),\n\t\t)\n\t}\n\n\ta.SigningMethod = signingMethod\n\n\treturn nil\n}\n\nfunc (a *AuthMeta) InitHttpClient() {\n\ta.httpClient = &http.Client{\n\t\tTimeout: 30 * time.Second,\n\t}\n}\n","sourceCodeStart":523,"sourceCodeEnd":557,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/authorization/auth.go#L523-L557","documentation":"This error is thrown by the JWT authorization layer when the algorithm specified in the auth configuration (a.Algo) is not present in the set of algorithms the library supports (e.g. HS256, RS256). initSigningMethod looks up the configured algorithm in supportedAlgorithms and returns this formatted error listing all valid options when the lookup fails. It prevents the server from signing/verifying tokens with an unrecognized algorithm.","triggerScenarios":"The GraphQL @auth directive (or config) declares a JWT algorithm string that is not one of the supported options, e.g. typo like 'hs256' vs 'HS256', 'RS512' when unsupported, or an empty Algo value.","commonSituations":"Typos in schema @auth(algorithm: ...) annotations; copying a config between libraries with different algorithm casing or sets; upgrading a library that dropped support for an older algorithm; leaving the algo field empty in the admin config.","solutions":["Check the @auth directive / JWT config and set algorithm to an exactly matching supported name (e.g. HS256, RS256)","Fix casing — algorithm names are case-sensitive in supportedAlgorithms","Run the query printing supportedAlgorithms from the error message and pick one from that list","Upgrade to a version that supports the algorithm you need, or switch signing keys to a supported algorithm"],"exampleFix":"// before\n# @auth(query: \"...\", algorithm: \"RS512\")\n// after\n# @auth(query: \"...\", algorithm: \"RS256\")","handlingStrategy":"validation","validationCode":"const supported = [\"HS256\",\"RS256\",\"RS384\",\"RS512\",\"ES256\"];\nfunction validateAlgo(algo) {\n  if (!supported.includes(algo)) {\n    throw new Error(`invalid jwt algorithm: ${algo}; supported: ${supported.join(\",\")}`);\n  }\n}","typeGuard":"function isSupportedAlgo(a) { return typeof a === 'string' && ['HS256','RS256','RS384','RS512','ES256'].includes(a); }","tryCatchPattern":null,"preventionTips":["Copy algorithm names exactly from the error's supported list","Keep JWT config in one reviewed place, version-controlled","Add a config startup check validating the algorithm before serving traffic","Pin library versions and review changelogs when algorithm support changes"],"tags":["jwt","authentication","configuration"],"backgroundTag":"jwt-algorithm-not-supported","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}