{"record":{"id":"a95bba9abd00932e","repo":"kataras/iris","slug":"refresh-w","errorCode":null,"errorMessage":"refresh: %w","messagePattern":"refresh: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth.go","lineNumber":303,"sourceCode":"\t}\n\n\tif refreshStdClaims.OriginID == \"\" {\n\t\t// keep a reference of the access token the refresh token is created,\n\t\t// if that access token is invalidated then\n\t\t// its refresh token should be too so the user can force-login.\n\t\trefreshStdClaims.OriginID = accessStdClaims.ID\n\t}\n\n\taccessToken, err := s.keys.SignToken(KIDAccess, t, accessStdClaims)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"access: %w\", err)\n\t}\n\n\tvar refreshToken []byte\n\tif s.refreshEnabled {\n\t\trefreshToken, err = s.keys.SignToken(KIDRefresh, t, refreshStdClaims)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"refresh: %w\", err)\n\t\t}\n\t}\n\n\treturn accessToken, refreshToken, nil\n}\n\n// SignHandler generates and sends a pair of access and refresh token to the client\n// as JSON body of `SigninResponse` and cookie (if cookie setting was provided).\n// See `Signin` method for more.\nfunc (s *Auth[T]) SigninHandler(ctx *context.Context) {\n\t// No, let the developer decide it based on a middleware, e.g. iris.LimitRequestBodySize.\n\t// ctx.SetMaxRequestBodySize(s.maxRequestBodySize)\n\n\tvar (\n\t\treq SigninRequest\n\t\terr error\n\t)\n","sourceCodeStart":285,"sourceCodeEnd":321,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/auth/auth.go#L285-L321","documentation":"This error wraps any failure that occurs while signing the refresh token inside Auth.sign(). It only fires when refresh tokens are enabled, i.e. the configuration's Keys contain a KIDRefresh key. The underlying error comes from the JWT signer (Key.SignToken), typically a bad or unusable key.","triggerScenarios":"s.refreshEnabled is true (a KIDRefresh key was configured) and s.keys.SignToken(KIDRefresh, t, refreshStdClaims) returns an error — e.g. the refresh key bytes are invalid, the algorithm and key type mismatch, or the key store fails to produce a signed token. Reached via Signin or Refresh.","commonSituations":"A KIDRefresh entry was added to config.Keys with malformed or too-short key material, an RSA key supplied where HMAC is expected, or a key file/env value that fails to parse during SignToken.","solutions":["Inspect the wrapped %w error to find the exact SignToken failure","Verify the KIDRefresh key material is valid and matches the configured algorithm","Confirm the KIDRefresh key type (HMAC secret vs RSA/ECDSA private key) matches c.Keys configuration","If refresh tokens are not needed, remove KIDRefresh from Keys so the refresh path is skipped"],"exampleFix":"// before\nKeys: map[string]jwt.Key{ \"access\": []byte(\"short\"), \"refresh\": \"\" }\n// after\nKeys: map[string]jwt.Key{ \"access\": []byte(longRandomSecret), \"refresh\": []byte(anotherLongRandomSecret) }","handlingStrategy":"try-catch","validationCode":"for kid := range map[string][]byte{\"access\": accessKey, \"refresh\": refreshKey} {\n    if len(k[kid]) == 0 { return fmt.Errorf(\"empty key material for %s\", kid) }\n}","typeGuard":null,"tryCatchPattern":"access, refresh, err := auth.Signin(ctx, username, password)\nif err != nil {\n    var cfgErr interface{ Unwrap() error }\n    if errors.Is(err, jwt.ErrKeyMismatch) { /* fix key config */ }\n    return fmt.Errorf(\"signin failed: %w\", err)\n}","preventionTips":["Validate key material length and type at startup before serving traffic","Only add KIDRefresh to Keys if you actually intend to use refresh flow","Add a startup smoke test that calls Signin in a staging environment","Keep signing secrets in a secret manager instead of hand-edited config files"],"tags":["jwt","signing","refresh-token","key-material"],"backgroundTag":"jwt-signing-key-invalid","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}