{"record":{"id":"70da913ba2d68be2","repo":"oauth2-proxy/oauth2-proxy","slug":"hmacauth-hash-algorithm-not-supported-name","errorCode":null,"errorMessage":"hmacauth: hash algorithm not supported: name","messagePattern":"hmacauth: hash algorithm not supported: name","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/authentication/hmacauth/hmacauth.go","lineNumber":71,"sourceCode":"\t\talgorithmName[algorithm] = name\n\t\t// Make sure the algorithm is linked into the binary, per\n\t\t// https://golang.org/pkg/crypto/#Hash.Available\n\t\t//\n\t\t// Note that both sides of the client/server connection must\n\t\t// have an algorithm available in order to successfully\n\t\t// authenticate using that algorithm\n\t\tif !algorithm.Available() {\n\t\t\tdelete(supportedAlgorithms, name)\n\t\t}\n\t}\n}\n\n// DigestNameToCryptoHash returns the crypto.Hash value corresponding to the\n// algorithm name, or an error if the algorithm is not supported.\nfunc DigestNameToCryptoHash(name string) (result crypto.Hash, err error) {\n\tvar supported bool\n\tif result, supported = supportedAlgorithms[name]; !supported {\n\t\terr = errors.New(\"hmacauth: hash algorithm not supported: \" +\n\t\t\tname)\n\t}\n\treturn\n}\n\n// CryptoHashToDigestName returns the algorithm name corresponding to the\n// crypto.Hash ID, or an error if the algorithm is not supported.\nfunc CryptoHashToDigestName(id crypto.Hash) (result string, err error) {\n\tvar supported bool\n\tif result, supported = algorithmName[id]; !supported {\n\t\terr = fmt.Errorf(\"hmacauth: unsupported crypto.Hash #%d\", id)\n\t}\n\treturn\n}\n\ntype hmacAuth struct {\n\thash    crypto.Hash\n\tkey     []byte","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/authentication/hmacauth/hmacauth.go#L53-L89","documentation":"DigestNameToCryptoHash in pkg/authentication/hmacauth/hmacauth.go maps a digest algorithm name (e.g. \"sha1\", \"sha256\") to a crypto.Hash via the supportedAlgorithms map. If the name is not in the map it returns this error. It is used when parsing signature keys for HMAC request authentication.","triggerScenarios":"parseSignatureKey or AuthenticateRequest receives a signature algorithm name not present in supportedAlgorithms, e.g. \"sha512-256\", \"SHA256\" (uppercase) or a misspelled name.","commonSituations":"Upstream service signs with an algorithm oauth2-proxy does not support; config uses uppercase or hyphenated names; docs/version drift between the signer and verifier.","solutions":["Use a supported lowercase algorithm name such as sha1 or sha256 as configured in supportedAlgorithms","Check the exact algorithm the upstream signer uses and match it verbatim (lowercase, no hyphens)","Update oauth2-proxy to a version whose supportedAlgorithms includes the needed hash, or patch the map"],"exampleFix":"// before\nauth, err := hmacauth.NewHmacAuth(\"SHA256\", []byte(key))\n// after\nauth, err := hmacauth.NewHmacAuth(\"sha256\", []byte(key))","handlingStrategy":"validation","validationCode":"if err := hmacauth.TestSupportedHashAlgorithm(alg); err != nil {\n\treturn fmt.Errorf(\"unsupported signature algorithm %q: %w\", alg, err)\n}","typeGuard":null,"tryCatchPattern":"h, err := hmacauth.DigestNameToCryptoHash(name)\nif err != nil {\n\treturn fmt.Errorf(\"fallback to sha256 for %q: %w\", name, err)\n}","preventionTips":["Keep algorithm names lowercase (sha1, sha256) exactly as supported by the library","Confirm the algorithm your upstream signer uses before configuring the verifier","Test config parsing at startup so unsupported algorithms fail fast"],"tags":["go","hmac","crypto","config"],"backgroundTag":"invalid-enum-value","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}