{"record":{"id":"3999d445dd164820","repo":"dgraph-io/dgraph","slug":"acl-is-disabled","errorCode":null,"errorMessage":"ACL is disabled","messagePattern":"ACL is disabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"x/jwt_helper.go","lineNumber":33,"sourceCode":"\nvar (\n\terrTokenExpired = errors.New(\"Token is expired\")\n)\n\n// MaybeKeyToBytes converts the x.Sensitive type into []byte if the type of interface really\n// is x.Sensitive. We keep the type x.Sensitive for private and public keys so that it\n// doesn't get printed into the logs but the type the JWT library needs is []byte.\nfunc MaybeKeyToBytes(k interface{}) interface{} {\n\tif kb, ok := k.(Sensitive); ok {\n\t\treturn []byte(kb)\n\t}\n\treturn k\n}\n\nfunc ParseJWT(jwtStr string) (jwt.MapClaims, error) {\n\ttoken, err := jwt.Parse(jwtStr, func(token *jwt.Token) (interface{}, error) {\n\t\tif WorkerConfig.AclJwtAlg == nil {\n\t\t\treturn nil, errors.Errorf(\"ACL is disabled\")\n\t\t}\n\t\tif token.Method.Alg() != WorkerConfig.AclJwtAlg.Alg() {\n\t\t\treturn nil, errors.Errorf(\"unexpected signing method in token: %v\", token.Header[\"alg\"])\n\t\t}\n\t\treturn MaybeKeyToBytes(WorkerConfig.AclPublicKey), nil\n\t})\n\tif err != nil {\n\t\t// This is for backward compatibility in clients\n\t\tif errors.Is(err, jwt.ErrTokenExpired) {\n\t\t\terr = errors.Wrap(errTokenExpired, jwt.ErrTokenInvalidClaims.Error())\n\t\t}\n\t\treturn nil, errors.Wrapf(err, \"unable to parse jwt token\")\n\t}\n\n\tclaims, ok := token.Claims.(jwt.MapClaims)\n\tif !ok || !token.Valid {\n\t\treturn nil, errors.Errorf(\"claims in jwt token is not map claims\")\n\t}","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/x/jwt_helper.go#L15-L51","documentation":"ParseJWT's key-function returns this error when the worker's ACL configuration has no signing algorithm set (WorkerConfig.AclJwtAlg == nil). It means JWT verification cannot proceed because ACLs are disabled or not initialized, so no key/algorithm is available to validate the token. It is a configuration-state guard, not a problem with the token itself.","triggerScenarios":"Calling ParseJWT (directly or via validateToken, ExtractUserName, ExtractNamespaceFromJwt) when WorkerConfig.AclJwtAlg was never populated — i.e. the server was started without ACL enabled or the config load step that sets AclJwtAlg/AclPublicKey was skipped.","commonSituations":"Starting Dgraph without --acl directives (ACL disabled) while clients still send access JWTs; a config/flag parsing bug leaving AclJwtAlg unset; upgrading and renaming config fields so the algorithm is no longer loaded.","solutions":["Enable and configure ACL on the node so WorkerConfig.AclJwtAlg is set (supply the ACL algorithm/key config at startup).","Verify the startup config actually populates AclJwtAlg before serving requests; add a startup check that fails fast if ACL is expected but unset.","If ACL is intentionally disabled, stop sending access JWTs to this node; treat any JWT as unauthenticated.","Guard callers: check WorkerConfig.AclJwtAlg != nil before calling ParseJWT and return a clear 'ACL disabled' error to clients."],"exampleFix":"// before (server started without ACL)\nWorkerConfig.AclJwtAlg == nil -> ParseJWT returns \"ACL is disabled\"\n// after (start with ACL enabled, e.g.)\ndgraph zero --acl \"access-ttl=24h; jwt-acl-alg=HS256\" ...\n// or guard:\nif WorkerConfig.AclJwtAlg == nil { return errors.New(\"ACL is disabled\") }","handlingStrategy":"validation","validationCode":"if WorkerConfig.AclJwtAlg == nil || WorkerConfig.AclPublicKey == nil {\n    return nil, errors.New(\"ACL is disabled: configure AclJwtAlg/AclPublicKey before authenticating\")\n}\n_, err := x.ParseJWT(token)","typeGuard":"func aclEnabled() bool { return WorkerConfig.AclJwtAlg != nil && WorkerConfig.AclPublicKey != nil }","tryCatchPattern":null,"preventionTips":["Fail fast at startup: abort boot if ACL should be on but AclJwtAlg is nil.","Keep ACL flags (alg + public key) in one config struct and load them together.","In client SDKs, detect the 'ACL is disabled' message and surface a config error instead of retrying.","Document that JWT auth endpoints require ACL to be enabled on the server."],"tags":["jwt","acl","config","authentication"],"backgroundTag":"acl-disabled","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}