{"record":{"id":"8093f58b06fcc426","repo":"kataras/iris","slug":"auth-verify-w","errorCode":null,"errorMessage":"auth: verify: %w","messagePattern":"auth: verify: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth.go","lineNumber":362,"sourceCode":"\t}\n\taccessToken := jwt.BytesToString(accessTokenBytes)\n\trefreshToken := jwt.BytesToString(refreshTokenBytes)\n\n\ts.trySetCookie(ctx, accessToken)\n\n\tresp := SigninResponse{\n\t\tAccessToken:  accessToken,\n\t\tRefreshToken: refreshToken,\n\t}\n\tctx.JSON(resp)\n}\n\n// Verify accepts a token and verifies it.\n// It returns the token's custom and standard JWT claims.\nfunc (s *Auth[T]) Verify(ctx stdContext.Context, token []byte, verifyFuncs ...VerifyUserFunc[T]) (T, StandardClaims, error) {\n\tt, claims, err := s.verify(ctx, token)\n\tif err != nil {\n\t\treturn t, StandardClaims{}, fmt.Errorf(\"auth: verify: %w\", err)\n\t}\n\n\tfor _, verify := range verifyFuncs {\n\t\tif verify == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\tif err = verify(t); err != nil {\n\t\t\treturn t, StandardClaims{}, fmt.Errorf(\"auth: verify: %w\", err)\n\t\t}\n\t}\n\n\treturn t, claims, nil\n}\n\nfunc (s *Auth[T]) verify(ctx stdContext.Context, token []byte) (T, StandardClaims, error) {\n\tvar t T\n","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/auth/auth.go#L344-L380","documentation":"The public Auth.Verify wraps any error from the internal s.verify() call (token parse, signature check, expiry, custom claims) with this prefix. It is the generic 'the token could not be verified' surface for library users.","triggerScenarios":"Calling Auth.Verify(ctx, token, verifyFuncs...) with a token that s.verify rejects: malformed token bytes, bad signature, expired token, wrong issuer/audience, or an internal claim extraction failure.","commonSituations":"Client sends an expired or tampered JWT, tokens signed with a different key than the server configured (e.g. after key rotation), or an empty/missing Authorization header value passed straight to Verify.","solutions":["Read the wrapped error to distinguish expiry vs signature vs malformed token","Re-sign the token client-side with the same key/algorithm the server configured","Check for clock skew or key-rotation mismatch between services","Ensure the full token (not a truncated header value like 'Bearer x') is passed to Verify"],"exampleFix":"// before\ntok := strings.TrimPrefix(req.Header.Get(\"Authorization\"), \"Bearer \")\nt, claims, err := auth.Verify(ctx, []byte(tok))\n// after\ntok := strings.TrimSpace(strings.TrimPrefix(req.Header.Get(\"Authorization\"), \"Bearer \"))\nif tok == \"\" { http.Error(w, \"missing token\", 401); return }\nt, claims, err := auth.Verify(ctx, []byte(tok))","handlingStrategy":"try-catch","validationCode":"tok := strings.TrimSpace(strings.TrimPrefix(req.Header.Get(\"Authorization\"), \"Bearer \"))\nif tok == \"\" { return errors.New(\"missing bearer token\") }","typeGuard":"func hasToken(h http.Header) ([]byte, bool) {\n    raw := strings.TrimPrefix(h.Get(\"Authorization\"), \"Bearer \")\n    return []byte(raw), len(raw) > 0 && strings.Count(raw, \".\") == 2\n}","tryCatchPattern":"t, claims, err := auth.Verify(ctx, token)\nif err != nil {\n    if errors.Is(err, jwt.ErrExpired) { http.Error(w, \"token expired\", http.StatusUnauthorized); return }\n    http.Error(w, \"invalid token\", http.StatusUnauthorized); return\n}","preventionTips":["Distinguish expiry from signature errors with errors.Is on the wrapped cause","Synchronize clocks (NTP) across services issuing and verifying tokens","Share key material/config across replicas to avoid mixed-key verification failures","Log the wrapped inner error (never the raw token) for diagnostics"],"tags":["jwt","token-verification","expired-token"],"backgroundTag":"jwt-token-verification-failed","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}