{"record":{"id":"abadecad2c5b1900","repo":"nats-io/nats-server","slug":"invalid-public-key","errorCode":null,"errorMessage":"invalid public key","messagePattern":"invalid public key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/dirstore.go","lineNumber":402,"sourceCode":"\tif !nkeys.IsValidPublicKey(publicKey) {\n\t\treturn _EMPTY_\n\t}\n\tfileName := fmt.Sprintf(\"%s%s\", publicKey, fileExtension)\n\tif store.shard {\n\t\tlast := publicKey[len(publicKey)-2:]\n\t\treturn filepath.Join(store.directory, last, fileName)\n\t} else {\n\t\treturn filepath.Join(store.directory, fileName)\n\t}\n}\n\n// Load checks the memory store and returns the matching JWT or an error\n// Assumes lock is NOT held\nfunc (store *DirJWTStore) load(publicKey string) (string, error) {\n\tstore.Lock()\n\tdefer store.Unlock()\n\tif path := store.pathForKey(publicKey); path == _EMPTY_ {\n\t\treturn _EMPTY_, fmt.Errorf(\"invalid public key\")\n\t} else if data, err := os.ReadFile(path); err != nil {\n\t\treturn _EMPTY_, err\n\t} else {\n\t\tif store.expiration != nil {\n\t\t\tstore.expiration.updateTrack(publicKey)\n\t\t}\n\t\treturn string(data), nil\n\t}\n}\n\n// write that keeps hash of all jwt in sync\n// Assumes the lock is held. Does return true or an error never both.\nfunc (store *DirJWTStore) write(path string, publicKey string, theJWT string) (bool, error) {\n\tif len(theJWT) == 0 {\n\t\treturn false, fmt.Errorf(\"invalid JWT\")\n\t}\n\tvar newHash *[sha256.Size]byte\n\tif store.expiration != nil {","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/dirstore.go#L384-L420","documentation":"DirJWTStore.load guard: pathForKey returned empty because nkeys.IsValidPublicKey failed for the lookup key, so the store refuses to build a file path for a malformed public key.","triggerScenarios":"Thrown at server/dirstore.go:402 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the public key string being looked up","Use a valid account/operator nkey","Regenerate credentials if the key is corrupt"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}