{"record":{"id":"3b211c885028d59c","repo":"grafana/k6","slug":"failed-to-decode-y-coordinate-w","errorCode":null,"errorMessage":"failed to decode Y coordinate: %w","messagePattern":"failed to decode Y coordinate: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/webcrypto/jwk.go","lineNumber":243,"sourceCode":"\t}\n\n\tif err := jwkKey.validate(); err != nil {\n\t\treturn nil, UnknownCryptoKeyType, fmt.Errorf(\"invalid EC JWK key: %w\", err)\n\t}\n\n\tcrv, err := pickEllipticCurve(jwkKey.Crv)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, fmt.Errorf(\"failed to parse elliptic curve: %w\", err)\n\t}\n\n\tx, err := base64URLDecode(jwkKey.X)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, fmt.Errorf(\"failed to decode X coordinate: %w\", err)\n\t}\n\n\ty, err := base64URLDecode(jwkKey.Y)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, fmt.Errorf(\"failed to decode Y coordinate: %w\", err)\n\t}\n\n\tpk := &ecdsa.PublicKey{\n\t\tCurve: crv,\n\t\tX:     new(big.Int).SetBytes(x),\n\t\tY:     new(big.Int).SetBytes(y),\n\t}\n\n\t// if the key is a public key, return it\n\tif jwkKey.D == \"\" {\n\t\treturn pk, PublicCryptoKeyType, nil\n\t}\n\n\td, err := base64URLDecode(jwkKey.D)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, fmt.Errorf(\"failed to decode D: %w\", err)\n\t}\n","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/webcrypto/jwk.go#L225-L261","documentation":"The y coordinate is decoded with base64.RawURLEncoding (unpadded base64url), exactly like x. This error indicates the y string is not valid unpadded base64url — padded values, standard base64 alphabet characters, embedded whitespace, or an impossible length. It surfaces from crypto.subtle.importKey('jwk', ...) for ECDSA.","triggerScenarios":"y contains '=', '+', '/', or whitespace; y was truncated during copy-paste; y re-encoded with a padded variant by an upstream service.","commonSituations":"Same class of issues as x: toolchains emitting padded base64url, PEM-derived values, or manual transcription. y is frequently mangled because it is the last field and trailing '=' padding is common.","solutions":["Convert y to unpadded base64url (replace '+'->'-', '/'->'_', strip trailing '=')","Remove any whitespace or line breaks embedded in the value","Confirm the decoded length matches the curve size (32/48/66 bytes for P-256/P-384/P-521)","Regenerate the JWK from the source key with a base64url-without-padding encoder"],"exampleFix":"// before\nconst jwk = { kty: 'EC', crv: 'P-256', x: b64uX, y: paddedY };\n// after\nconst toB64u = (s) => s.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '').trim();\nconst jwk = { kty: 'EC', crv: 'P-256', x: b64uX, y: toB64u(paddedY) };","handlingStrategy":"validation","validationCode":"const B64URL = /^[A-Za-z0-9_-]+$/;\nconst toB64u = (s) => String(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '').trim();\nconst y = toB64u(jwk.y);\nif (!B64URL.test(y) || y.length < 2) throw new Error('y is not valid unpadded base64url');","typeGuard":"function isB64uCoord(s) {\n  return typeof s === 'string' && /^[A-Za-z0-9_-]+$/.test(s) && s.length % 4 !== 1;\n}","tryCatchPattern":"try {\n  key = await crypto.subtle.importKey('jwk', jwk, alg, true, usages);\n} catch (e) {\n  if (e.message.includes('failed to decode Y coordinate')) {\n    jwk = { ...jwk, y: toB64u(jwk.y) };\n    key = await crypto.subtle.importKey('jwk', jwk, alg, true, usages);\n  } else throw e;\n}","preventionTips":["Apply the same unpadded-base64url normalization to every field, not just x","y is the most common place to find leftover '=' padding — check it explicitly","Validate x and y byte lengths match the curve before importing"],"tags":["webcrypto","jwk","import","ecdsa","base64url","k6"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}