{"record":{"id":"92062c5707b6c2dc","repo":"Tencent/WeKnora","slug":"missing-expiration","errorCode":null,"errorMessage":"missing expiration","messagePattern":"missing expiration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/middleware/auth.go","lineNumber":640,"sourceCode":"\t\tjwt.WithAudience(\"weknora\"),\n\t\tjwt.WithExpirationRequired(),\n\t\tjwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),\n\t)\n\ttoken, err := parser.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {\n\t\tif _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {\n\t\t\treturn nil, fmt.Errorf(\"unexpected signing method: %v\", token.Header[\"alg\"])\n\t\t}\n\t\treturn []byte(secret), nil\n\t})\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif token == nil || !token.Valid {\n\t\treturn \"\", errors.New(\"invalid external user token\")\n\t}\n\texp, err := claims.GetExpirationTime()\n\tif err != nil || exp == nil {\n\t\treturn \"\", errors.New(\"missing expiration\")\n\t}\n\tif time.Until(exp.Time) > maxExternalUserTokenTTL {\n\t\treturn \"\", fmt.Errorf(\"token lifetime exceeds %s\", maxExternalUserTokenTTL)\n\t}\n\tif nbf, nbfErr := claims.GetNotBefore(); nbfErr == nil && nbf != nil && time.Now().Before(nbf.Time) {\n\t\treturn \"\", errors.New(\"token not yet valid\")\n\t}\n\tif got := principalTenantIDFromClaims(claims); got != tenantID {\n\t\treturn \"\", fmt.Errorf(\"workspace mismatch: got %d want %d\", got, tenantID)\n\t}\n\tsub, _ := claims[\"sub\"].(string)\n\tsub = strings.TrimSpace(sub)\n\tif sub == \"\" {\n\t\treturn \"\", errors.New(\"missing subject\")\n\t}\n\treturn sub, nil\n}\n","sourceCodeStart":622,"sourceCodeEnd":658,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/middleware/auth.go#L622-L658","documentation":"Ad-hoc error created in verifyExternalUserJWT when claims.GetExpirationTime() returns nil or errors — the external user JWT carries no exp claim. The parser is configured with jwt.WithExpirationRequired(), and this check is the fallback ensuring an expiration actually exists before the token is accepted.","triggerScenarios":"Thrown at internal/middleware/auth.go:640 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Token issuer must include an exp claim in the external user JWT","Use a JWT library setting that always emits exp","Reject and re-issue the token; tokens without expiry are unsafe for this auth mode"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}