{"record":{"id":"9d8e89006dbd11eb","repo":"nats-io/nats-server","slug":"invalid-jwt","errorCode":null,"errorMessage":"invalid JWT","messagePattern":"invalid JWT","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/dirstore.go","lineNumber":417,"sourceCode":"\tstore.Lock()\n\tdefer store.Unlock()\n\tif path := store.pathForKey(publicKey); path == _EMPTY_ {\n\t\treturn _EMPTY_, fmt.Errorf(\"invalid public key\")\n\t} else if data, err := os.ReadFile(path); err != nil {\n\t\treturn _EMPTY_, err\n\t} else {\n\t\tif store.expiration != nil {\n\t\t\tstore.expiration.updateTrack(publicKey)\n\t\t}\n\t\treturn string(data), nil\n\t}\n}\n\n// write that keeps hash of all jwt in sync\n// Assumes the lock is held. Does return true or an error never both.\nfunc (store *DirJWTStore) write(path string, publicKey string, theJWT string) (bool, error) {\n\tif len(theJWT) == 0 {\n\t\treturn false, fmt.Errorf(\"invalid JWT\")\n\t}\n\tvar newHash *[sha256.Size]byte\n\tif store.expiration != nil {\n\t\th := sha256.Sum256([]byte(theJWT))\n\t\tnewHash = &h\n\t\tif v, ok := store.expiration.idx[publicKey]; ok {\n\t\t\tstore.expiration.updateTrack(publicKey)\n\t\t\t// this write is an update, move to back\n\t\t\tit := v.Value.(*jwtItem)\n\t\t\toldHash := it.hash[:]\n\t\t\tif bytes.Equal(oldHash, newHash[:]) {\n\t\t\t\treturn false, nil\n\t\t\t}\n\t\t} else if int64(store.expiration.Len()) >= store.expiration.limit {\n\t\t\tif !store.expiration.evictOnLimit {\n\t\t\t\treturn false, errors.New(\"jwt store is full\")\n\t\t\t}\n\t\t\t// this write is an add, pick the least recently used value for removal","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/dirstore.go#L399-L435","documentation":"DirJWTStore.write guard: theJWT is empty (zero length), so there is nothing to persist and the write is rejected as an invalid JWT before touching disk or the expiration tracker.","triggerScenarios":"Thrown at server/dirstore.go:417 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a non-empty serialized JWT to save","Check upstream claim serialization before saving","Skip writes when the JWT is empty rather than erroring, if the caller treats it as optional"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}