{"record":{"id":"68ebd6298f999817","repo":"kubernetes/kops","slug":"incorrect-authorization-algorithm","errorCode":null,"errorMessage":"incorrect authorization algorithm","messagePattern":"incorrect authorization algorithm","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":171,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding authorization token: %w\", err)\n\t}\n\tvar decoded awsV1Token\n\tif err := json.Unmarshal(tokenBytes, &decoded); err != nil {\n\t\treturn nil, fmt.Errorf(\"unmarshalling authorization token: %w\", err)\n\t}\n\n\t// Verify the token has signed the body content.\n\tsha := sha256.Sum256(body)\n\tdecodedHeaders := http.Header(decoded)\n\n\tif decodedHeaders.Get(\"X-Kops-Request-SHA\") != base64.RawStdEncoding.EncodeToString(sha[:]) {\n\t\treturn nil, fmt.Errorf(\"incorrect SHA\")\n\t}\n\n\tauthorization := decodedHeaders.Get(\"Authorization\")\n\tif !strings.HasPrefix(authorization, \"AWS4-HMAC-SHA256 \") {\n\t\treturn nil, fmt.Errorf(\"incorrect authorization algorithm\")\n\t}\n\n\tamzSignature := \"\"\n\tamzCredential := \"\"\n\tamzSignedHeaders := \"\"\n\n\tfor _, token := range strings.Split(strings.TrimPrefix(authorization, \"AWS4-HMAC-SHA256 \"), \", \") {\n\t\tkv := strings.SplitN(token, \"=\", 2)\n\t\tif len(kv) == 1 {\n\t\t\treturn nil, fmt.Errorf(\"incorrect authorization format\")\n\t\t}\n\t\tgot := kv[1]\n\t\tswitch kv[0] {\n\t\tcase \"Signature\":\n\t\t\tamzSignature = got\n\t\tcase \"Credential\":\n\t\t\tamzCredential = got\n\t\tcase \"SignedHeaders\":","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L153-L189","documentation":"verifyTokenV1 checks that the Authorization header inside the signed token starts with the expected AWS SigV4 algorithm prefix (AWS4-HMAC-SHA256). This guard fires when the header is present but uses a different/unknown signing algorithm — a malformed or malicious token that should not proceed to STS validation.","triggerScenarios":"Thrown at pkg/bootstrap/awsbootstrap/verifier.go:171 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the token contains an AWS4-HMAC-SHA256 authorization","Generate tokens with the kOps-provided helper","Match the expected SigV4 format exactly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}