{"record":{"id":"3f6248463e905efc","repo":"plandex-ai/plandex","slug":"error-parsing-auth-token-v","errorCode":null,"errorMessage":"error parsing auth token: %v","messagePattern":"error parsing auth token: (.+?)","errorType":"validation","errorClass":null,"httpStatus":401,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":74,"sourceCode":"\t\treturn nil, fmt.Errorf(\"invalid auth header\")\n\t}\n\n\t// strip off the \"Bearer \" prefix\n\tencoded := strings.TrimPrefix(authHeader, \"Bearer \")\n\n\t// decode the base64-encoded credentials\n\tbytes, err := base64.URLEncoding.DecodeString(encoded)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error decoding auth token: %v\", err)\n\t}\n\n\t// parse the credentials\n\tvar parsed shared.AuthHeader\n\terr = json.Unmarshal(bytes, &parsed)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing auth token: %v\", err)\n\t}\n\n\treturn &parsed, nil\n}\n\nfunc ClearAuthCookieIfBrowser(w http.ResponseWriter, r *http.Request) error {\n\tacceptHeader := r.Header.Get(\"Accept\")\n\tif acceptHeader == \"\" {\n\t\t// no accept header, not a browser request\n\t\treturn nil\n\t}\n\n\t// Check for existing auth cookie\n\t_, err := r.Cookie(\"authToken\")\n\tif err == http.ErrNoCookie {\n\t\t// No auth cookie, nothing to clear\n\t\treturn nil\n\t}","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L56-L92","documentation":"After successful base64 decoding, GetAuthHeader unmarshals the bytes into shared.AuthHeader; a JSON parse failure is wrapped with this message. The decoded payload must be valid JSON with the expected AuthHeader fields (Token, OrgId).","triggerScenarios":"The base64 decodes fine but the plaintext is not valid JSON, or the JSON structure doesn't match shared.AuthHeader — e.g. a raw session token string (no JSON braces), wrong field names, or a token produced by a different/older format.","commonSituations":"Client passes an opaque token string instead of the encoded JSON credentials, version mismatch between token issuer and parser (schema change), or manual token crafting.","solutions":["Ensure the client encodes JSON of shared.AuthHeader ({\"token\":...,\"orgId\":...}) before base64url encoding, not a raw token string","Re-authenticate to obtain a freshly minted token in the current format","Check for version skew between services issuing and parsing tokens","Validate the decoded payload is JSON before sending (json.Valid on the plaintext)","Clear stale cookies/tokens and sign in again"],"exampleFix":"// before\nencoded := base64.URLEncoding.EncodeToString([]byte(token)) // raw token, not JSON\n// after\npayload, _ := json.Marshal(shared.AuthHeader{Token: token, OrgId: orgId})\nencoded := base64.URLEncoding.EncodeToString(payload)","handlingStrategy":"validation","validationCode":"// client side, before encoding\npayload, err := json.Marshal(shared.AuthHeader{Token: token, OrgId: orgId})\nif err != nil { return fmt.Errorf(\"cannot serialize auth header: %w\", err) }\nencoded := base64.URLEncoding.EncodeToString(payload)","typeGuard":null,"tryCatchPattern":"authHeader, err := GetAuthHeader(r)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"error parsing auth token\") { http.Error(w, \"unrecognized token format, sign in again\", http.StatusUnauthorized); return }\n    http.Error(w, err.Error(), http.StatusUnauthorized)\n}","preventionTips":["Never base64-encode a raw token string; encode the AuthHeader JSON struct","Keep the token schema in a shared package so issuer and parser agree","When changing AuthHeader fields, version the token or bump a format field","Round-trip test: marshal→encode→decode→unmarshal equals original"],"tags":["go","auth","json","token"],"backgroundTag":"malformed-auth-token","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}