{"record":{"id":"9004b88860fac9e5","repo":"kgretzky/evilginx2","slug":"auth-tokens-invalid-token-type-s","errorCode":null,"errorMessage":"auth_tokens: invalid token type: %s","messagePattern":"auth_tokens: invalid token type: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":527,"sourceCode":"\t\t\tif ic.Body != nil {\n\t\t\t\tbody = *ic.Body\n\t\t\t}\n\t\t\tif ic.Mime != nil {\n\t\t\t\tmime = *ic.Mime\n\t\t\t}\n\t\t\terr = p.addIntercept(*ic.Domain, path_re, *ic.HttpStatus, body, mime)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tfor _, at := range *fp.AuthTokens {\n\t\tttype := \"cookie\"\n\t\tif at.Type != nil {\n\t\t\tttype = *at.Type\n\t\t}\n\t\tif !stringExists(ttype, AUTH_TOKEN_TYPES) {\n\t\t\treturn fmt.Errorf(\"auth_tokens: invalid token type: %s\", ttype)\n\t\t}\n\t\tswitch ttype {\n\t\tcase \"cookie\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for cookie auth token\")\n\t\t\t}\n\t\t\tif at.Keys == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'keys' not found for cookie auth token\")\n\t\t\t}\n\n\t\t\tfor n := range *at.Keys {\n\t\t\t\t(*at.Keys)[n] = p.paramVal((*at.Keys)[n])\n\t\t\t}\n\t\t\terr := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"body\":","sourceCodeStart":509,"sourceCodeEnd":545,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L509-L545","documentation":"This error is thrown while validating a phishlet's `auth_tokens` section when an entry's `type` field contains a value not present in AUTH_TOKEN_TYPES (only \"cookie\" and \"body\" are supported). The default type is \"cookie\" when omitted; an explicit but unknown type is rejected at load time.","triggerScenarios":"An auth_tokens entry specifies `type: header`, `type: bearer`, `type: session`, or any misspelled value other than `cookie` or `body`.","commonSituations":"Guessing at token type names; copying auth token config from another tool with a different type vocabulary; typo like `type: cookies` (plural).","solutions":["Change the `type` value to either `cookie` or `body`, the only supported token types.","Remove the `type` field entirely if the token is a cookie, since cookie is the default.","Check spelling and singular form (`cookie`, not `cookies`)."],"exampleFix":"// before (phishlet.yml)\nauth_tokens:\n  - type: header\n    domain: accounts\n// after\nauth_tokens:\n  - type: body\n    domain: accounts\n    path: ^/api/login$\n    name: session\n    search: ([A-Za-z0-9]+)","handlingStrategy":"validation","validationCode":"var AUTH_TOKEN_TYPES = []string{\"cookie\", \"body\"}\n\nfor i, at := range cfg.AuthTokens {\n    t := \"cookie\"\n    if at.Type != nil {\n        t = *at.Type\n    }\n    if !contains(AUTH_TOKEN_TYPES, t) {\n        return fmt.Errorf(\"auth_tokens[%d]: invalid token type: %s\", i, t)\n    }\n}","typeGuard":"func isKnownTokenType(t string) bool {\n    return t == \"cookie\" || t == \"body\"\n}","tryCatchPattern":null,"preventionTips":["Use only `cookie` or `body` as auth_tokens type values.","Omit the `type` key for cookie tokens to rely on the default.","Copy token entries from official example phishlets rather than other tools' configs."],"tags":["phishlet","configuration","auth-tokens","yaml-validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}