{"record":{"id":"4baec437f1b190d3","repo":"netbirdio/netbird","slug":"invalid-token-data-insufficient-length","errorCode":null,"errorMessage":"invalid token data: insufficient length","messagePattern":"invalid token data: insufficient length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/relay/auth/hmac/v2/token.go","lineNumber":31,"sourceCode":"\n\tbuf := make([]byte, size)\n\n\tbuf[0] = byte(t.AuthAlgo)\n\tcopy(buf[1:], t.Signature)\n\tcopy(buf[1+len(t.Signature):], t.Payload)\n\n\treturn buf\n}\n\nfunc UnmarshalToken(data []byte) (*Token, error) {\n\tif len(data) == 0 {\n\t\treturn nil, errors.New(\"invalid token data\")\n\t}\n\n\talgo := AuthAlgo(data[0])\n\tsigSize := algo.Size()\n\tif len(data) < 1+sigSize {\n\t\treturn nil, errors.New(\"invalid token data: insufficient length\")\n\t}\n\n\treturn &Token{\n\t\tAuthAlgo:  algo,\n\t\tSignature: data[1 : 1+sigSize],\n\t\tPayload:   data[1+sigSize:],\n\t}, nil\n}\n","sourceCodeStart":13,"sourceCodeEnd":40,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/shared/relay/auth/hmac/v2/token.go#L13-L40","documentation":"UnmarshalToken accepted a non-empty buffer but needs at least 1 + algo.Size() bytes: one byte selecting the AuthAlgo, then that algorithm's fixed signature, then the payload. Shorter data fails here. A frequent root cause is a corrupted or version-mismatched token whose first byte decodes to an algorithm with a signature larger than the remaining data.","triggerScenarios":"A truncated token from a partial stream read; a token produced by an incompatible token-format version; random bytes where the algo byte implies a large signature size.","commonSituations":"Mixed relay auth versions across a self-hosted fleet; frames cut short by transport issues; hand-assembled test buffers sized only for the payload.","solutions":["Regenerate the token on the issuing side (management) and retry","Verify both ends use the same relay auth package version","Read the full announced frame length before unmarshalling"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Minimum structural size: 1 algo byte + smallest supported signature.\nif len(data) < 1+AuthAlgounknown.Size() { // use the algo you expect the peer to use\n\treturn fmt.Errorf(\"relay token frame too short: %d bytes\", len(data))\n}","typeGuard":null,"tryCatchPattern":"token, err := UnmarshalToken(data)\nif err != nil {\n\tif strings.Contains(err.Error(), \"insufficient length\") {\n\t\t// request a fresh token; do not re-parse the same bytes\n\t}\n\treturn nil, err\n}","preventionTips":["Read complete frames (announced length) before unmarshalling","Keep issuer and validator on the same relay auth package version","Regenerate tokens rather than patching malformed ones"],"tags":["relay","auth","hmac","token","corruption"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}