{"record":{"id":"7b5ac40d60c4cd2e","repo":"Tencent/WeKnora","slug":"invalid-jwk-exponent-value","errorCode":null,"errorMessage":"invalid JWK exponent value","messagePattern":"invalid JWK exponent value","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1861,"sourceCode":"\nfunc (k oidcJWK) rsaPublicKey() (*rsa.PublicKey, error) {\n\tif !strings.EqualFold(k.Kty, \"RSA\") {\n\t\treturn nil, fmt.Errorf(\"unsupported JWK key type: %s\", k.Kty)\n\t}\n\tnBytes, err := decodeJWKBase64(k.N)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid JWK modulus: %w\", err)\n\t}\n\teBytes, err := decodeJWKBase64(k.E)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid JWK exponent: %w\", err)\n\t}\n\tif len(nBytes) == 0 || len(eBytes) == 0 {\n\t\treturn nil, errors.New(\"empty JWK modulus or exponent\")\n\t}\n\teInt := new(big.Int).SetBytes(eBytes)\n\tif !eInt.IsInt64() {\n\t\treturn nil, errors.New(\"invalid JWK exponent value\")\n\t}\n\te := int(eInt.Int64())\n\tif e <= 0 {\n\t\treturn nil, errors.New(\"invalid JWK exponent value\")\n\t}\n\treturn &rsa.PublicKey{N: new(big.Int).SetBytes(nBytes), E: e}, nil\n}\n\nfunc (jwks *oidcJWKS) rsaKeyForKid(kid string) (*rsa.PublicKey, error) {\n\tvar usable []oidcJWK\n\tfor _, k := range jwks.Keys {\n\t\tif k.Use != \"\" && !strings.EqualFold(k.Use, \"sig\") {\n\t\t\tcontinue\n\t\t}\n\t\tif k.Kty != \"\" && !strings.EqualFold(k.Kty, \"RSA\") {\n\t\t\tcontinue\n\t\t}\n\t\tif kid != \"\" && k.Kid != kid {","sourceCodeStart":1843,"sourceCodeEnd":1879,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1843-L1879","documentation":"The decoded JWK exponent does not fit in an int64 (big-endian bytes exceed 8 bytes or overflow), so it cannot become the int exponent of an rsa.PublicKey. RFC 7518 exponents are small (typically 65537 = \"AQAB\"), so this value is not a usable RSA exponent.","triggerScenarios":"decodeJWKBase64(k.E) succeeds but the resulting big.Int does not fit IsInt64() — e.g. 'e' is an absurdly long base64url string in the JWKS entry.","commonSituations":"Corrupted or maliciously crafted JWKS entries; tests feeding malformed 'e' values; a key with swapped n/e fields.","solutions":["Inspect the 'e' field in the JWKS — it should normally be \"AQAB\" (65537).","Re-fetch the JWKS from the provider's canonical jwks_uri.","Filter out keys with non-standard exponent encodings before use.","If this is a test, fix the fixture so 'e' decodes to a small positive integer."],"exampleFix":"// before\n\"e\": \"AAAAAAAAAAAAAAAAAAAAAQAB\" // >8 bytes\n// after\n\"e\": \"AQAB\"","handlingStrategy":"validation","validationCode":"eBytes, err := base64.RawURLEncoding.DecodeString(k.E)\nif err != nil || len(eBytes) == 0 || len(eBytes) > 8 {\n    return fmt.Errorf(\"JWK %q has invalid exponent\", k.Kid)\n}","typeGuard":"func plausibleExponent(k jwk) bool {\n    e, err := base64.RawURLEncoding.DecodeString(k.E)\n    return err == nil && len(e) > 0 && len(e) <= 8\n}","tryCatchPattern":null,"preventionTips":["Expect 'e' to be \"AQAB\" (65537) in virtually all providers; flag anything else.","Validate JWK fields when ingesting a JWKS into any local cache.","Fix test fixtures to use standard exponent encodings."],"tags":["jwks","rsa","exponent","oidc"],"backgroundTag":"jwks-invalid-rsa-key","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}