{"record":{"id":"afd48f1b9c4e2df6","repo":"Pumpkin-MC/Pumpkin","slug":"ecdsa-signature-error-0","errorCode":null,"errorMessage":"ECDSA signature error: {0}","messagePattern":"ECDSA signature error: (.+?)","errorType":"error_code","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-auth/src/jwt/mod.rs","lineNumber":54,"sourceCode":"    #[error(\"x5u not found in header\")]\n    MissingX5U,\n    /// Indicates a failure in Base64 decoding.\n    #[error(\"Base64 decoding failed: {0}\")]\n    Base64Decode(#[from] base64::DecodeError),\n    /// Indicates a failure in parsing JSON data.\n    #[error(\"JSON parse error: {0}\")]\n    JsonParse(#[from] serde_json::Error),\n    /// Indicates a failure in building a public key from its representation.\n    #[error(\"Public key build failed: {0}\")]\n    PublicKeyBuild(String),\n    /// Indicates that the token was not signed by the trusted Mojang public key.\n    #[error(\"Token not signed by trusted Mojang key\")]\n    MojangKeyMismatch,\n    /// Indicates that the token's signature is invalid.\n    #[error(\"Invalid signature\")]\n    InvalidSignature,\n    /// Indicates an error related to ECDSA signature operations.\n    #[error(\"ECDSA signature error: {0}\")]\n    Ecdsa(#[from] ecdsa::Error),\n}\n\n/// Decodes a Base64 URL-safe encoded string with no padding.\n///\n/// # Arguments\n///\n/// * `s` - The Base64 URL-safe encoded string to decode.\n///\n/// # Returns\n///\n/// A `Result` containing the decoded bytes or a `base64::DecodeError`.\npub fn decode_b64_url_nopad(s: &str) -> Result<Vec<u8>, base64::DecodeError> {\n    general_purpose::URL_SAFE_NO_PAD.decode(s)\n}\n\n/// Decodes a standard Base64 encoded string.\n///","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-auth/src/jwt/mod.rs#L36-L72","documentation":"This variant wraps an underlying ecdsa::Error from the `ecdsa` crate, covering low-level ECDSA signature operation failures during JWT verification. It is distinct from InvalidSignature: it signals malformed signature encoding or internal crypto errors rather than a simple verification mismatch.","triggerScenarios":"Constructing a Signature from bytes of the wrong length/format, or calling sign/verify APIs where the ecdsa crate returns an operational error, during Mojang token validation.","commonSituations":"Tokens whose signature field is not exactly 64 bytes of r||s; corrupted DER-encoded signatures; using a crypto crate version whose signature format expectations changed.","solutions":["Check the signature byte length and format (64-byte r||s vs DER) before constructing the Signature","Log the wrapped ecdsa::Error to distinguish malformed encoding from verification failure","Pin consistent versions of the p256/ecdsa crates; format handling changed across versions","Treat as an auth failure and reject the client, since the signature cannot be processed"],"exampleFix":"// before\nlet sig = Signature::<NistP256>::from_slice(&sig_bytes)?;\n// after\nlet sig = Signature::<NistP256>::from_slice(&sig_bytes)\n    .map_err(|e| {\n        log::warn!(\"client sent malformed ECDSA signature: {e}\");\n        AuthError::Ecdsa(e)\n    })?;","handlingStrategy":"try-catch","validationCode":"// ECDSA P-256 signatures are 64 bytes (r || s)\nfn signature_bytes_look_valid(sig: &[u8]) -> bool {\n    sig.len() == 64\n}","typeGuard":"fn is_raw_ecdsa_signature(sig: &[u8]) -> bool {\n    sig.len() == 64\n}","tryCatchPattern":"match jwt::verify(&token) {\n    Err(jwt::Error::Ecdsa(e)) => {\n        log::warn!(\"ECDSA operation failed on token: {e}; rejecting client\");\n    }\n    r => r?,\n}","preventionTips":["Check signature byte length (64 for raw r||s) before constructing a Signature","Pin compatible p256/ecdsa crate versions in Cargo.toml","Log the wrapped ecdsa::Error to separate encoding issues from trust issues","Reject clients whose signatures cannot be parsed"],"tags":["ecdsa","jwt","cryptography","signature","rust"],"backgroundTag":"invalid-signature-format","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}