{"record":{"id":"90c49d586e8ad81c","repo":"kubernetes/kops","slug":"decoding-authorization-token-w-90c49d","errorCode":null,"errorMessage":"decoding authorization token: %w","messagePattern":"decoding authorization token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go","lineNumber":74,"sourceCode":"\t}\n\treturn &verifier{\n\t\topt:    opt,\n\t\tclient: client,\n\t}, nil\n}\n\nvar _ bootstrap.Verifier = &verifier{}\n\n// TODO: Dedup with gce\nfunc (v *verifier) parseTokenData(tokenPrefix string, authToken string, body []byte) (*pkibootstrap.AuthToken, *pkibootstrap.AuthTokenData, error) {\n\tif !strings.HasPrefix(authToken, tokenPrefix) {\n\t\treturn nil, nil, bootstrap.ErrNotThisVerifier\n\t}\n\tauthToken = strings.TrimPrefix(authToken, tokenPrefix)\n\n\ttokenBytes, err := base64.StdEncoding.DecodeString(authToken)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"decoding authorization token: %w\", err)\n\t}\n\n\ttoken := &pkibootstrap.AuthToken{}\n\tif err = json.Unmarshal(tokenBytes, token); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unmarshalling authorization token: %w\", err)\n\t}\n\n\ttokenData := &pkibootstrap.AuthTokenData{}\n\tif err := json.Unmarshal(token.Data, tokenData); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unmarshalling authorization token data: %w\", err)\n\t}\n\n\t// Guard against replay attacks\n\tif tokenData.Audience != pkibootstrap.AudienceNodeAuthentication {\n\t\treturn nil, nil, fmt.Errorf(\"incorrect Audience\")\n\t}\n\ttimeSkew := math.Abs(time.Since(time.Unix(tokenData.Timestamp, 0)).Seconds())\n\tif timeSkew > float64(v.opt.MaxTimeSkew) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go#L56-L92","documentation":"The bearer token presented to the PKI verifier is not valid base64 after its expected prefix was stripped: the prefix matched (so this verifier was selected) but the payload is malformed — truncated, re-encoded, or carrying extra characters.","triggerScenarios":"Thrown at pkg/bootstrap/pkibootstrap/pkiverifier/verifier.go:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the token is forwarded intact (no truncation or double encoding)","Ensure the client uses the same base64 alphabet (StdEncoding) as the verifier","Re-issue the token from the node"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}