{"record":{"id":"adae1dfe9ceb2558","repo":"dgraph-io/dgraph","slug":"unsupported-jwt-signing-algorithm-for-acl-v","errorCode":null,"errorMessage":"Unsupported JWT signing algorithm for ACL: %v","messagePattern":"Unsupported JWT signing algorithm for ACL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"x/acl_enc_keys.go","lineNumber":81,"sourceCode":"\t\t}\n\t\tvar err error\n\t\tif aclKey, err = os.ReadFile(aclSecretFile); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading ACL secret key from file: %s: %s\", aclSecretFile, err)\n\t\t}\n\t}\n\n\tkeys := &Keys{\n\t\tAclSecretKeyBytes: aclKey,\n\t\tAclAccessTtl:      aclSuperFlag.GetDuration(flagAclAccessTtl),\n\t\tAclRefreshTtl:     aclSuperFlag.GetDuration(flagAclRefreshTtl),\n\t\tEncKey:            encKey,\n\t}\n\n\tif aclKey != nil {\n\t\talgStr := aclSuperFlag.GetString(flagAclJwtAlg)\n\t\taclAlg := jwt.GetSigningMethod(algStr)\n\t\tif aclAlg == nil {\n\t\t\treturn nil, fmt.Errorf(\"Unsupported JWT signing algorithm for ACL: %v\", algStr)\n\t\t}\n\t\tif err := checkAclKeyLength(aclAlg, aclKey); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tprivKey, pubKey, err := parseJWTKey(aclAlg, aclKey)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tkeys.AclJwtAlg = aclAlg\n\t\tkeys.AclSecretKey = privKey\n\t\tkeys.AclPublicKey = pubKey\n\t}\n\n\treturn keys, nil\n}\n\nfunc parseJWTKey(alg jwt.SigningMethod, key Sensitive) (interface{}, interface{}, error) {","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/x/acl_enc_keys.go#L63-L99","documentation":"GetEncAclKeys reads the configured JWT algorithm string (flagAclJwtAlg) and resolves it with jwt.GetSigningMethod. If the string is not a recognized golang-jwt signing method (e.g. misspelled or an unsupported alg), aclAlg is nil and this error is returned before any key parsing.","triggerScenarios":"Setting the ACL jwt-alg superflag component to an unknown/misspelled algorithm name, empty string, or an algorithm not compiled in (e.g. 'rs256' lowercase vs 'RS256', 'HS512 ' with whitespace).","commonSituations":"Typo in the dgraph --acl flag; copying an algorithm name from a different JWT library with different casing; expecting RS384 support when the vendored jwt lib lacks it.","solutions":["Set jwt-alg to one of the exact supported values: HS256/HS384/HS512, RS256/RS384/RS512, PS*, ES256/ES384/ES512, EdDSA","Use uppercase as golang-jwt's GetSigningMethod expects","Remove the jwt-alg component to fall back to the default","Check the message's %v to see exactly what string was passed"],"exampleFix":"// before\n--acl \"hmac-secret=...;jwt-alg=rs256\"\n// after\n--acl \"hmac-secret=...;jwt-alg=RS256\"","handlingStrategy":"validation","validationCode":"alg := \"HS256\" // or RS256, ES256, EdDSA...\nif jwt.GetSigningMethod(alg) == nil {\n    return fmt.Errorf(\"unsupported jwt alg %q; use HS256/384/512, RS/PS/ES*, EdDSA\", alg)\n}\n_, err := x.GetEncAclKeys(aclSuperFlag, encKey)","typeGuard":null,"tryCatchPattern":"if _, err := x.GetEncAclKeys(flag, encKey); err != nil {\n    if strings.Contains(err.Error(), \"Unsupported JWT signing algorithm\") {\n        log.Fatalf(\"fix jwt-alg value: %v\", err)\n    }\n    return err\n}","preventionTips":["Use exact uppercase algorithm names as golang-jwt defines them","Keep a whitelist of supported algs in your config validator","Fail fast at startup rather than mid-restore"],"tags":["config","jwt","acl","validation"],"backgroundTag":"unsupported-jwt-algorithm","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}