{"record":{"id":"7d574a83225923cf","repo":"dgraph-io/dgraph","slug":"no-jwkurl-supplied","errorCode":null,"errorMessage":"No JWKUrl supplied","messagePattern":"No JWKUrl supplied","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/authorization/auth.go","lineNumber":430,"sourceCode":"\t\treturn nil, errors.Errorf(\"unable to parse jwt token:%v\", err)\n\t}\n\n\tclaims, ok := token.Claims.(*CustomClaims)\n\tif !ok || !token.Valid {\n\t\treturn nil, errors.Errorf(\"claims in jwt token is not map claims\")\n\t}\n\n\tif err := claims.validateAudience(); err != nil {\n\t\treturn nil, err\n\t}\n\treturn claims, nil\n}\n\n// FetchJWKs fetches the JSON Web Key sets for the JWKUrls. It returns an error if\n// the fetching of key is failed even for one of the JWKUrl.\nfunc (a *AuthMeta) FetchJWKs() error {\n\tif len(a.JWKUrls) == 0 {\n\t\treturn errors.Errorf(\"No JWKUrl supplied\")\n\t}\n\n\tfor i := range a.JWKUrls {\n\t\terr := a.FetchJWK(i)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\n// FetchJWK fetches the JSON web Key set for the JWKUrl at a given index.\nfunc (a *AuthMeta) FetchJWK(i int) error {\n\tif len(a.JWKUrls) <= i {\n\t\treturn errors.Errorf(\"not enough JWKUrls\")\n\t}\n\n\treq, err := http.NewRequest(\"GET\", a.JWKUrls[i], nil)","sourceCodeStart":412,"sourceCodeEnd":448,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/authorization/auth.go#L412-L448","documentation":"FetchJWKs fetches a JWK set for every configured JWKUrl, and refuses to run when the JWKUrls slice is empty — there is nothing to fetch. It signals that AuthMeta was created without any JWK URL even though JWK-based authentication is being attempted.","triggerScenarios":"Calling AuthMeta.FetchJWKs() (typically at service startup before serving requests) while a.JWKUrls has length 0.","commonSituations":"Config file missing the jwk_urls key or parsed as empty list; env var for JWKS URL unset; constructing AuthOptions in code and forgetting JWKUrls; YAML/JSON structure mismatch so the field binds elsewhere.","solutions":["Populate JWKUrls with your identity provider's JWKS endpoint(s), e.g. https://<issuer>/.well-known/jwks.json.","Check the config/env plumbing so the JWK URLs actually reach AuthMeta at startup.","Fail fast at boot: treat empty JWKUrls as fatal config if JWKS auth is expected.","If you intend static-key auth instead, skip FetchJWKs and set Algo/VerificationKey.","Add a startup config dump (redacting secrets) to catch empty lists."],"exampleFix":"// before\nauth := &authorization.AuthOptions{ Algo: \"RS256\" }\nerr := auth.FetchJWKs() // \"No JWKUrl supplied\"\n// after\nauth := &authorization.AuthOptions{\n    Algo: \"RS256\",\n    JWKUrls: []string{\"https://idp.example.com/.well-known/jwks.json\"},\n}\nif err := auth.FetchJWKs(); err != nil {\n    log.Fatalf(\"failed to fetch JWKs: %v\", err)\n}","handlingStrategy":"validation","validationCode":"if len(cfg.JWKUrls) == 0 {\n    return errors.New(\"startup aborted: auth.jwk_urls must contain at least one JWKS endpoint\")\n}\nif err := auth.FetchJWKs(); err != nil {\n    return fmt.Errorf(\"startup aborted: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := auth.FetchJWKs(); err != nil {\n    if strings.Contains(err.Error(), \"No JWKUrl supplied\") {\n        log.Fatal(\"config error: no JWK URLs configured for JWKS authentication\")\n    }\n    return err\n}","preventionTips":["Call FetchJWKs during startup and treat failure as fatal","Validate config schema so jwk_urls is required when auth mode is JWKS","Add integration test asserting JWK fetch succeeds with prod-like config","Log effective (redacted) auth config at boot"],"tags":["configuration","jwk","misconfiguration","startup"],"backgroundTag":"missing-config-value","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}