{"record":{"id":"68a35b0d482682a5","repo":"netbirdio/netbird","slug":"invalid-payload-insufficient-length","errorCode":null,"errorMessage":"invalid payload: insufficient length","messagePattern":"invalid payload: insufficient length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/relay/auth/hmac/v2/validator.go","lineNumber":33,"sourceCode":"}\n\nfunc NewValidator(secret []byte) *Validator {\n\treturn &Validator{secret: secret}\n}\n\nfunc (v *Validator) Validate(data any) error {\n\td, ok := data.([]byte)\n\tif !ok {\n\t\treturn fmt.Errorf(\"invalid data type\")\n\t}\n\n\ttoken, err := UnmarshalToken(d)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unmarshal token: %w\", err)\n\t}\n\n\tif len(token.Payload) < minLengthUnixTimestamp {\n\t\treturn errors.New(\"invalid payload: insufficient length\")\n\t}\n\n\thashFunc := token.AuthAlgo.New()\n\tif hashFunc == nil {\n\t\treturn fmt.Errorf(\"unsupported auth algorithm: %s\", token.AuthAlgo)\n\t}\n\n\th := hmac.New(hashFunc, v.secret)\n\th.Write(token.Payload)\n\texpectedMAC := h.Sum(nil)\n\n\tif !hmac.Equal(token.Signature, expectedMAC) {\n\t\treturn errors.New(\"invalid signature\")\n\t}\n\n\ttimestamp, err := strconv.ParseInt(string(token.Payload), 10, 64)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid payload: %w\", err)","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/shared/relay/auth/hmac/v2/validator.go#L15-L51","documentation":"Validator.Validate requires the token payload to be at least minLengthUnixTimestamp bytes, because the payload is a decimal Unix timestamp that the validator later parses and expiry-checks. The token decoded structurally but its payload is too short to hold that timestamp, so it was not produced by the matching Marshal counterpart or was truncated after the signature.","triggerScenarios":"Hand-crafted or version-skewed tokens whose payload omits the timestamp; a frame truncated exactly after the signature bytes.","commonSituations":"Integrations building tokens manually instead of using MarshalToken; management and relay running different auth versions; malformed fixtures in tests.","solutions":["Create tokens only with the MarshalToken from the same package version as the validator","Reissue the token from management","Verify relay and management run the same auth version"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := validator.Validate(data); err != nil {\n\tif strings.Contains(err.Error(), \"invalid payload: insufficient length\") {\n\t\t// token not minted by a compatible MarshalToken; reissue it\n\t}\n\treturn err\n}","preventionTips":["Only mint tokens with MarshalToken from the same version as the validator","Never hand-assemble token payloads","Version-pin management and relay when token formats change"],"tags":["relay","auth","hmac","token","payload"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}