{"record":{"id":"59e458306ced954f","repo":"kubernetes/kops","slug":"unmarshalling-authorization-token-w-59e458","errorCode":null,"errorMessage":"unmarshalling authorization token: %w","messagePattern":"unmarshalling authorization token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go","lineNumber":79,"sourceCode":"}\n\nvar _ bootstrap.Verifier = &verifier{}\n\n// TODO: Dedup with gce\nfunc (v *verifier) parseTokenData(tokenPrefix string, authToken string, body []byte) (*pkibootstrap.AuthToken, *pkibootstrap.AuthTokenData, error) {\n\tif !strings.HasPrefix(authToken, tokenPrefix) {\n\t\treturn nil, nil, bootstrap.ErrNotThisVerifier\n\t}\n\tauthToken = strings.TrimPrefix(authToken, tokenPrefix)\n\n\ttokenBytes, err := base64.StdEncoding.DecodeString(authToken)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"decoding authorization token: %w\", err)\n\t}\n\n\ttoken := &pkibootstrap.AuthToken{}\n\tif err = json.Unmarshal(tokenBytes, token); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unmarshalling authorization token: %w\", err)\n\t}\n\n\ttokenData := &pkibootstrap.AuthTokenData{}\n\tif err := json.Unmarshal(token.Data, tokenData); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unmarshalling authorization token data: %w\", err)\n\t}\n\n\t// Guard against replay attacks\n\tif tokenData.Audience != pkibootstrap.AudienceNodeAuthentication {\n\t\treturn nil, nil, fmt.Errorf(\"incorrect Audience\")\n\t}\n\ttimeSkew := math.Abs(time.Since(time.Unix(tokenData.Timestamp, 0)).Seconds())\n\tif timeSkew > float64(v.opt.MaxTimeSkew) {\n\t\treturn nil, nil, fmt.Errorf(\"incorrect Timestamp %v\", tokenData.Timestamp)\n\t}\n\n\t// Verify the token has signed the body content.\n\trequestHash := sha256.Sum256(body)","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go#L61-L97","documentation":"The base64-decoded token bytes are not a JSON AuthToken object: the token decoded but does not match the expected schema, e.g. a token produced by an incompatible token version or corrupted between issuance and verification.","triggerScenarios":"Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:79 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify client and verifier run compatible token versions","Confirm the token was produced by the matching CreateToken implementation","Regenerate the token on the node and retry verification"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}