{"record":{"id":"b13c249f18cf00fc","repo":"oauth2-proxy/oauth2-proxy","slug":"hmacauth-unsupported-crypto-hash-d","errorCode":null,"errorMessage":"hmacauth: unsupported crypto.Hash #%d","messagePattern":"hmacauth: unsupported crypto\\.Hash #(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/authentication/hmacauth/hmacauth.go","lineNumber":82,"sourceCode":"}\n\n// DigestNameToCryptoHash returns the crypto.Hash value corresponding to the\n// algorithm name, or an error if the algorithm is not supported.\nfunc DigestNameToCryptoHash(name string) (result crypto.Hash, err error) {\n\tvar supported bool\n\tif result, supported = supportedAlgorithms[name]; !supported {\n\t\terr = errors.New(\"hmacauth: hash algorithm not supported: \" +\n\t\t\tname)\n\t}\n\treturn\n}\n\n// CryptoHashToDigestName returns the algorithm name corresponding to the\n// crypto.Hash ID, or an error if the algorithm is not supported.\nfunc CryptoHashToDigestName(id crypto.Hash) (result string, err error) {\n\tvar supported bool\n\tif result, supported = algorithmName[id]; !supported {\n\t\terr = fmt.Errorf(\"hmacauth: unsupported crypto.Hash #%d\", id)\n\t}\n\treturn\n}\n\ntype hmacAuth struct {\n\thash    crypto.Hash\n\tkey     []byte\n\theader  string\n\theaders []string\n}\n\n// NewHmacAuth returns an HmacAuth object that can be used to sign or\n// authenticate HTTP requests based on the supplied parameters.\nfunc NewHmacAuth(hash crypto.Hash, key []byte, header string,\n\theaders []string) HmacAuth {\n\tif !hash.Available() {\n\t\tvar name string\n\t\tvar supported bool","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/authentication/hmacauth/hmacauth.go#L64-L100","documentation":"CryptoHashToDigestName in pkg/authentication/hmacauth maps a crypto.Hash ID to its digest name (e.g. SHA256) via the algorithmName lookup table; unsupported IDs produce this error. Callers using HMAC signature validation with a hash the library has no name mapping for get this failure.","triggerScenarios":"Calling CryptoHashToDigestName with a crypto.Hash value not present in the algorithmName map — e.g. MD5, or a newer/less-common hash — when constructing an HMAC auth session.","commonSituations":"Configuring an HMAC signature header algorithm with crypto.MD5 or another unsupported hash; library updated to a crypto.Hash constant the map doesn't cover; mixing code that assumes all crypto.Hash values are supported.","solutions":["Use a supported hash such as crypto.SHA256 when building the hmacauth session","Check the algorithmName map in hmacauth.go for the list of supported crypto.Hash values","Update oauth2-proxy to a version whose algorithmName map includes your hash, if a newer one added it","If you must use another algorithm, add it to the algorithmName map in a fork/patch"],"exampleFix":"// before\nsession, err := hmacauth.NewHMACAuth(crypto.MD5, key)\n// after\nsession, err := hmacauth.NewHMACAuth(crypto.SHA256, key)","handlingStrategy":"validation","validationCode":"switch hash {\ncase crypto.SHA256, crypto.SHA384, crypto.SHA512:\n\t// supported by hmacauth\ndefault:\n\treturn fmt.Errorf(\"hash %v not supported by hmacauth\", hash)\n}","typeGuard":"func isSupportedHash(id crypto.Hash) bool {\n\t_, ok := algorithmName[id]\n\treturn ok\n}","tryCatchPattern":"name, err := hmacauth.CryptoHashToDigestName(hash)\nif err != nil {\n\t// fall back to crypto.SHA256 or reject the configuration\n\treturn err\n}","preventionTips":["Use SHA-2 family hashes (SHA256/384/512) with hmacauth","Avoid MD5 or newer crypto.Hash constants not in the algorithmName map","Check hmacauth.go's algorithmName map when adding algorithms"],"tags":["hmac","crypto-hash","unsupported-algorithm","signature"],"backgroundTag":"unsupported-enum-value","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}