{"record":{"id":"6b137327af9c299b","repo":"Tencent/WeKnora","slug":"failed-to-decode-jwks-document-w","errorCode":null,"errorMessage":"failed to decode JWKS document: %w","messagePattern":"failed to decode JWKS document: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1925,"sourceCode":"\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, jwksURI, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\tresp, err := newOIDCHTTPClient().Do(req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\tif resp.StatusCode < 200 || resp.StatusCode >= 300 {\n\t\t_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 2048))\n\t\treturn nil, fmt.Errorf(\"JWKS request failed: status=%d\", resp.StatusCode)\n\t}\n\n\tvar jwks oidcJWKS\n\tif err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&jwks); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode JWKS document: %w\", err)\n\t}\n\tif len(jwks.Keys) == 0 {\n\t\treturn nil, errors.New(\"JWKS document contains no keys\")\n\t}\n\treturn &jwks, nil\n}\n\nconst oidcIDTokenLeeway = 2 * time.Minute\n\n// verifyOIDCIDToken cryptographically verifies an OIDC id_token: it checks the\n// RSA signature against the provider's JWKS (matched by kid) and validates the\n// issuer, audience (client_id), expiry and subject. It returns the verified claims.\nfunc (s *userService) verifyOIDCIDToken(\n\tctx context.Context, cfg *config.OIDCAuthConfig, idToken string,\n) (map[string]interface{}, error) {\n\tif strings.TrimSpace(cfg.JwksURI) == \"\" {\n\t\treturn nil, errors.New(\"cannot verify OIDC id_token: no jwks_uri configured\")\n\t}","sourceCodeStart":1907,"sourceCodeEnd":1943,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1907-L1943","documentation":"fetchOIDCJWKS wraps the JSON decode failure of the identity provider's JWKS document: the IdP returned 2xx but the body was not a parseable JWKS (HTML error page, truncation, wrong content type). OIDC login cannot verify id_tokens until a valid key set is fetched.","triggerScenarios":"Thrown at internal/application/service/user.go:1925 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify jwks_uri points to the correct OIDC discovery document endpoint","Check the IdP is healthy and returns application/json JWKS","Confirm the response is under the 1MB read limit and not proxied/corrupted"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}