{"record":{"id":"4cde3653d9c193e5","repo":"Pumpkin-MC/Pumpkin","slug":"token-not-signed-by-trusted-mojang-key","errorCode":null,"errorMessage":"Token not signed by trusted Mojang key","messagePattern":"Token not signed by trusted Mojang key","errorType":"error_code","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-auth/src/jwt/mod.rs","lineNumber":48,"sourceCode":"#[derive(Debug, Error)]\npub enum AuthError {\n    /// Indicates that a JWT token has an invalid format (not enough parts).\n    #[error(\"Invalid token format\")]\n    InvalidTokenFormat,\n    /// Indicates that the 'x5u' (X.509 URL) header parameter is missing from a token.\n    #[error(\"x5u not found in header\")]\n    MissingX5U,\n    /// Indicates a failure in Base64 decoding.\n    #[error(\"Base64 decoding failed: {0}\")]\n    Base64Decode(#[from] base64::DecodeError),\n    /// Indicates a failure in parsing JSON data.\n    #[error(\"JSON parse error: {0}\")]\n    JsonParse(#[from] serde_json::Error),\n    /// Indicates a failure in building a public key from its representation.\n    #[error(\"Public key build failed: {0}\")]\n    PublicKeyBuild(String),\n    /// Indicates that the token was not signed by the trusted Mojang public key.\n    #[error(\"Token not signed by trusted Mojang key\")]\n    MojangKeyMismatch,\n    /// Indicates that the token's signature is invalid.\n    #[error(\"Invalid signature\")]\n    InvalidSignature,\n    /// Indicates an error related to ECDSA signature operations.\n    #[error(\"ECDSA signature error: {0}\")]\n    Ecdsa(#[from] ecdsa::Error),\n}\n\n/// Decodes a Base64 URL-safe encoded string with no padding.\n///\n/// # Arguments\n///\n/// * `s` - The Base64 URL-safe encoded string to decode.\n///\n/// # Returns\n///\n/// A `Result` containing the decoded bytes or a `base64::DecodeError`.","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-auth/src/jwt/mod.rs#L30-L66","documentation":"This error means a JWT presented by a client was cryptographically valid or parseable, but the public key it carries (or is signed with) does not match the trusted Mojang public key. The library refuses to accept tokens whose signing key differs from Mojang's, since such tokens cannot be trusted to authenticate a player's identity.","triggerScenarios":"Verifying a player's chat/session/profile token where the embedded x5u key or the signature verification key comparison against the hardcoded Mojang public key fails.","commonSituations":"Modified clients or third-party launchers forging tokens; man-in-the-middle/proxy tampering with tokens; attempting offline-mode players against a server that enforces Mojang-signed keys.","solutions":["Reject the player's authentication attempt; this error is by design and not recoverable","Check that the client is a genuine, unmodified Minecraft client connecting with a real Mojang account","Ensure no proxy or intermediary is altering the token's key header in transit","If testing locally, use legitimate session tokens rather than hand-crafted JWTs"],"exampleFix":"// before\nmatch jwt::verify(&token) {\n    Err(jwt::Error::MojangKeyMismatch) => {},\n    other => other?,\n}\n// after\njwt::verify(&token)?; // key mismatch => disconnect client with 'invalid public key'","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match jwt::verify(&token) {\n    Err(jwt::Error::MojangKeyMismatch) => {\n        // disconnect player: token is not signed by the trusted Mojang key\n    }\n    r => r?,\n}","preventionTips":["Enforce online-mode so only genuine Mojang tokens reach verification","Never accept or bypass key-mismatch failures; they indicate forgery or tampering","Keep the trusted Mojang public key constant updated with official client releases","Ensure proxies pass tokens through unmodified"],"tags":["jwt","signature","mojang","authentication","rust"],"backgroundTag":"jwt-signature-verification-failed","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}