{"record":{"id":"9036ff09b58bebdc","repo":"cloudflare/cloudflared","slug":"malformed-jwt-v","errorCode":null,"errorMessage":"malformed jwt: %v","messagePattern":"malformed jwt: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"management/token.go","lineNumber":46,"sourceCode":"// verify compares the tun claim isn't empty\nfunc (t *tunnel) verify() bool {\n\treturn t.AccountTag != \"\" && t.ID != \"\"\n}\n\ntype actor struct {\n\tID      string `json:\"id\"`\n\tSupport bool   `json:\"support\"`\n}\n\n// verify checks the ID claim isn't empty\nfunc (t *actor) verify() bool {\n\treturn t.ID != \"\"\n}\n\nfunc ParseToken(token string) (*managementTokenClaims, error) {\n\tjwt, err := jwt.ParseSigned(token, []jose.SignatureAlgorithm{jose.ES256})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"malformed jwt: %v\", err)\n\t}\n\n\tvar claims managementTokenClaims\n\t// This is actually safe because we verify the token in the edge before it reaches cloudflared\n\terr = jwt.UnsafeClaimsWithoutVerification(&claims)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"malformed jwt: %v\", err)\n\t}\n\tif !claims.verify() {\n\t\treturn nil, fmt.Errorf(\"invalid management token format provided\")\n\t}\n\treturn &claims, nil\n}\n\nfunc (m *managementTokenClaims) IsFed() bool {\n\treturn m.Issuer == tunnelstoreFEDIssuer\n}\n","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/management/token.go#L28-L64","documentation":"Raised by management.ParseToken when jose's jwt.ParseSigned fails on the management token: the token is not a syntactically valid compact JWS or is not signed with ES256. Used by `cloudflared tail` (buildURL) to inspect token claims before connecting; a malformed token means the access token passed via --token is corrupt or truncated.","triggerScenarios":"Thrown at management/token.go:46 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-run `cloudflared tunnel login` / re-fetch the management token; the current token is corrupt.","Ensure the full token string was passed (no truncation or shell quoting damage).","Confirm the token is an ES256-signed JWT from Cloudflare access."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}