{"record":{"id":"7a4073b28bfcafe3","repo":"ory/hydra","slug":"failed-to-decode-json-web-key-set","errorCode":null,"errorMessage":"failed to decode JSON Web Key Set","messagePattern":"failed to decode JSON Web Key Set","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/jwk_sdk.go","lineNumber":27,"sourceCode":"\n\tjose \"github.com/go-jose/go-jose/v3\"\n\t\"github.com/pkg/errors\"\n\n\thydra \"github.com/ory/hydra-client-go/v2\"\n)\n\n// OnlyPublicSDKKeys strips the private parts from a key set so that it is safe\n// to print.\nfunc OnlyPublicSDKKeys(in []hydra.JsonWebKey) (out []hydra.JsonWebKey, _ error) {\n\tvar interim []jose.JSONWebKey\n\tvar b bytes.Buffer\n\n\tif err := json.NewEncoder(&b).Encode(&in); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to encode JSON Web Key Set\")\n\t}\n\n\tif err := json.NewDecoder(&b).Decode(&interim); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to decode JSON Web Key Set\")\n\t}\n\n\tfor i, key := range interim {\n\t\tinterim[i] = key.Public()\n\t}\n\n\tb.Reset()\n\tif err := json.NewEncoder(&b).Encode(&interim); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to encode JSON Web Key Set\")\n\t}\n\n\tvar keys []hydra.JsonWebKey\n\tif err := json.NewDecoder(&b).Decode(&keys); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to decode JSON Web Key Set\")\n\t}\n\n\treturn keys, nil\n}","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/cmd/jwk_sdk.go#L9-L45","documentation":"In OnlyPublicSDKKeys the encoded key set is decoded back into []jose.JSONWebKey (interim). This error wraps a json.Decoder failure on that round-trip — meaning the JSON produced by the earlier encode step could not be parsed into jose.JSONWebKey, indicating corrupt or structurally incompatible JSON.","triggerScenarios":"The bytes.Buffer round-trip decoding fails: only reachable if the encode step produced JSON that Decode rejects, which for valid JsonWebKey input effectively cannot occur; it surfaces if a custom JsonWebKey marshals to a non-object JSON value.","commonSituations":"Practically only seen with corrupted or adversarially-crafted JsonWebKey values; also possible if a vendored version mismatch makes hydra.JsonWebKey marshal differently than jose.JSONWebKey expects.","solutions":["Inspect the wrapped decode error's Offset/field to see which JSON shape was rejected.","Ensure hydra.JsonWebKey and jose.JSONWebKey versions are aligned (go mod tidy / update ory/hydra and go-jose to compatible versions).","Log the intermediate JSON (b.String()) to diagnose the mismatch."],"exampleFix":"// debug\nif err := json.NewDecoder(&b).Decode(&interim); err != nil {\n    log.Printf(\"jwk json: %s\", b.String())\n    return nil, err\n}","handlingStrategy":"try-catch","validationCode":"if b, err := json.Marshal(in); err != nil || !json.Valid(b) {\n    return fmt.Errorf(\"key set did not round-trip to valid JSON\")\n}","typeGuard":null,"tryCatchPattern":"out, err := OnlyPublicSDKKeys(keys)\nif err != nil {\n    log.Printf(\"jwk conversion error: %+v\", err) // wrapped decode error shows JSON offset\n    return nil, err\n}","preventionTips":["Pin go-jose and ory/hydra versions together; run go mod tidy after upgrades.","Sanity-check JWK payloads are JSON objects (never arrays/scalars).","Add a unit test round-tripping a sample key set through OnlyPublicSDKKeys."],"tags":["jwk","json","deserialization","sdk"],"backgroundTag":"json-deserialization-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}