{"record":{"id":"5be1bf379375f07b","repo":"googleapis/mcp-toolbox","slug":"invalid-jwks-uri-detected","errorCode":null,"errorMessage":"invalid jwks_uri detected","messagePattern":"invalid jwks_uri detected","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":173,"sourceCode":"\t\tJwksUri               string `json:\"jwks_uri\"`\n\t\tIntrospectionEndpoint string `json:\"introspection_endpoint\"`\n\t}\n\tif err := json.Unmarshal(body, &config); err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tif config.Issuer == \"\" {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"issuer not found in config\")\n\t}\n\n\tif config.JwksUri == \"\" {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"jwks_uri not found in config\")\n\t}\n\n\t// Sanitize the resulting JWKS URI before returning it\n\tparsedJWKS, err := url.Parse(config.JwksUri)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"invalid jwks_uri detected\")\n\t}\n\tif parsedJWKS.Scheme != \"https\" {\n\t\tlog.Printf(\"WARNING: HTTP instead of HTTPS is being used for JWKS URI: %s\", config.JwksUri)\n\t}\n\n\treturn config.JwksUri, config.IntrospectionEndpoint, config.Issuer, nil\n}\n\nvar _ auth.MCPAuthService = AuthService{}\n\n// struct used to store auth service info\ntype AuthService struct {\n\tConfig\n\tkf               keyfunc.Keyfunc\n\tclient           *http.Client\n\tintrospectionURL string\n\tissuer           string\n}","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L155-L191","documentation":"The jwks_uri value from the discovery document could not be parsed by url.Parse during sanitization. The library validates the advertised JWKS URL before handing it to keyfunc; an unparseable URI is rejected with this error.","triggerScenarios":"config.JwksUri contains a string net/url.Parse rejects (invalid characters or percent-encoding), discovered from the OIDC config document during Initialize().","commonSituations":"A misbehaving or malicious authorization server advertising a malformed jwks_uri (e.g. containing spaces or invalid %-sequences); corrupted discovery document from a broken proxy.","solutions":["Inspect the discovery document's jwks_uri value with curl","Fix the provider so it advertises a well-formed absolute https URL","Check for proxy middleware corrupting the discovery JSON","If you control the provider, validate its config for stray characters"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var doc struct{ JwksUri string `json:\"jwks_uri\"` }\njson.NewDecoder(resp.Body).Decode(&doc)\nif _, err := url.Parse(doc.JwksUri); err != nil {\n    return fmt.Errorf(\"provider advertises malformed jwks_uri %q: %v\", doc.JwksUri, err)\n}","typeGuard":null,"tryCatchPattern":"_, err := cfg.Initialize()\nif err != nil && strings.Contains(err.Error(), \"invalid jwks_uri detected\") {\n    log.Fatalf(\"auth provider discovery doc is corrupted or malicious: %v\", err)\n}","preventionTips":["Fetch the discovery doc over TLS only (HTTPS enforcement prevents tampering)","Inspect jwks_uri with curl when setting up a new provider","Investigate any proxy middleware that could rewrite response JSON"],"tags":["go","url","jwks","oidc"],"backgroundTag":"jwks-url-invalid","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}