{"record":{"id":"b727a9b8a64e02ce","repo":"kgretzky/evilginx2","slug":"auth-tokens-path-not-found-for-http-auth-token","errorCode":null,"errorMessage":"auth_tokens: 'path' not found for http auth token","messagePattern":"auth_tokens: 'path' not found for http auth token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":568,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'search' not found for body auth token\")\n\t\t\t}\n\n\t\t\terr := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"http\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Header == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'header' not found for http auth token\")\n\t\t\t}\n\n\t\t\terr := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tfor _, au := range fp.AuthUrls {\n\t\tre, err := regexp.Compile(p.paramVal(au))\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":550,"sourceCodeEnd":586,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L550-L586","documentation":"Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'path' field. The path scopes the request URL for the header token; without it the library cannot match requests, so the phishlet is rejected.","triggerScenarios":"A phishlet YAML defines an http auth_tokens entry with domain/name/header but omits 'path', or 'path' is misplaced by indentation.","commonSituations":"Hand-written phishlet missing path; assuming path defaults to '/' (it does not); copied config where path was deleted during editing.","solutions":["Add a 'path:' field (usually '/') to the http auth_tokens entry","Confirm the path regex matches the target URL path where the token is sent","Re-validate the phishlet after editing"],"exampleFix":"// before\n  - type: http\n    domain: '.example.com'\n    name: Authorization\n    header: Authorization\n// after\n  - type: http\n    domain: '.example.com'\n    path: '/'\n    name: Authorization\n    header: Authorization","handlingStrategy":"validation","validationCode":"for i, at := range cfg.AuthTokens {\n  if at.Type == \"http\" && (at.Path == nil || *at.Path == \"\") {\n    return fmt.Errorf(\"auth_tokens[%d]: http token missing 'path'\", i)\n  }\n}","typeGuard":"func hasPath(at AuthToken) bool { return at.Path != nil && *at.Path != \"\" }","tryCatchPattern":null,"preventionTips":["Never omit path; use '/' as the default","Check the entry structure against a reference phishlet","Validate before loading"],"tags":["phishlet","config","yaml","validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}