{"record":{"id":"3fe47d27aa7bb298","repo":"googleapis/mcp-toolbox","slug":"no-refresh-jwt-found-in-the-response","errorCode":null,"errorMessage":"no refresh JWT found in the response","messagePattern":"no refresh JWT found in the response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/sources/dgraph/dgraph.go","lineNumber":334,"sourceCode":"\t\treturn err\n\t}\n\n\tvar r struct {\n\t\tData struct {\n\t\t\tAccessJWT  string `json:\"accessJWT\"`\n\t\t\tRefreshJWT string `json:\"refreshJWT\"`\n\t\t} `json:\"data\"`\n\t}\n\n\tif err := json.Unmarshal(resp, &r); err != nil {\n\t\treturn fmt.Errorf(\"failed to unmarshal response: %v\", err)\n\t}\n\n\tif r.Data.AccessJWT == \"\" {\n\t\treturn fmt.Errorf(\"no access JWT found in the response\")\n\t}\n\tif r.Data.RefreshJWT == \"\" {\n\t\treturn fmt.Errorf(\"no refresh JWT found in the response\")\n\t}\n\n\thc.AccessJwt = r.Data.AccessJWT\n\thc.RefreshToken = r.Data.RefreshJWT\n\treturn nil\n}\n\nfunc (hc *DgraphClient) healthCheck() error {\n\turl, err := getUrl(hc.baseUrl, \"/health\", nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\treq, err := http.NewRequest(http.MethodGet, url, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error creating request: %w\", err)\n\t}\n\n\tresp, err := hc.httpClient.Do(req)","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/dgraph/dgraph.go#L316-L352","documentation":"The login response contained a valid accessJWT but data.refreshJWT was empty, so doLogin rejects the response. Dgraph is expected to return both tokens from /login; a missing refresh token means the session cannot be renewed and indicates an abnormal or partial authentication response. doLogin fails rather than storing an unrenewable token pair.","triggerScenarios":"Dgraph /login returns JSON with accessJWT set but refreshJWT absent or empty — abnormal server-side login behavior, non-standard login endpoints/proxies stripping the field, or Dgraph versions/configs that do not issue refresh tokens (e.g. when logging in with a refresh token under unusual conditions).","commonSituations":"Proxy or middleware rewriting the /login response; version drift where the response schema changed; ACL misconfiguration issuing only an access token; custom login handlers on the Dgraph side.","solutions":["Inspect the raw /login response to confirm refreshJWT is genuinely absent rather than a parsing-struct tag mismatch.","Verify the Dgraph version matches the response schema {\"data\":{\"accessJWT\":...,\"refreshJWT\":...}}; upgrade or adjust the parsing struct accordingly.","Remove any intermediary proxy that could rewrite or filter the login response fields.","Re-run login with valid user credentials (not a refresh token) to force Dgraph to issue a fresh token pair.","If only an access token is ever issued, consider treating accessJWT-only as acceptable by relaxing the check in a fork — at the cost of losing session refresh."],"exampleFix":"// before\nif r.Data.RefreshJWT == \"\" {\n  return fmt.Errorf(\"no refresh JWT found in the response\")\n}\n// after (fork: tolerate missing refresh token)\nif r.Data.RefreshJWT == \"\" {\n  hc.AccessJwt = r.Data.AccessJWT\n  return nil // session valid but not renewable\n}","handlingStrategy":"type-guard","validationCode":"// verify the raw response actually contains refreshJWT before login flow proceeds\nvar probe map[string]json.RawMessage\nif err := json.Unmarshal(resp, &probe); err != nil {\n  return err\n}\nif _, ok := probe[\"refreshJWT\"]; !ok && probe[\"data\"] == nil {\n  log.Println(\"warning: login response missing refreshJWT\")\n}","typeGuard":"func hasBothTokens(r loginResponse) bool {\n  return r.Data.AccessJWT != \"\" && r.Data.RefreshJWT != \"\"\n}\nif !hasBothTokens(r) { /* handle missing refresh token */ }","tryCatchPattern":"if err := doLogin(...); err != nil {\n  if strings.Contains(err.Error(), \"no refresh JWT\") {\n    // re-login with user/password instead of refresh token, or check for response-rewriting proxies\n    log.Printf(\"incomplete dgraph login response: %v\", err)\n    return\n  }\n}","preventionTips":["Log the full /login response once during setup to confirm both JWT fields are present.","Keep the Dgraph version aligned with the response schema the parser expects.","Remove proxies/middleware that rewrite or strip fields from the login response.","Prefer initial login with user/password over refresh-token login to get a complete token pair.","Store the refresh token securely on first login so subsequent sessions can be renewed."],"tags":["authentication","jwt","refresh-token","dgraph","login"],"backgroundTag":"missing-refresh-token","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}