{"record":{"id":"ba2ef72ec92dcfe3","repo":"dgraph-io/dgraph","slug":"couldn-t-parse-signing-method-from-token-header","errorCode":null,"errorMessage":"couldn't parse signing method from token header: %s","messagePattern":"couldn't parse signing method from token header: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/authorization/auth.go","lineNumber":407,"sourceCode":"\t\t// The JWT library supports comparison of `aud` in JWT against a single string. Hence, we\n\t\t// disable the `aud` claim verification at the library end using `WithoutAudienceValidation` and\n\t\t// use our custom validation function `validateAudience`.\n\t\ttoken, err =\n\t\t\tjwt.ParseWithClaims(jwtStr, &CustomClaims{authMeta: a}, func(token *jwt.Token) (interface{}, error) {\n\t\t\t\talgo, _ := token.Header[\"alg\"].(string)\n\t\t\t\tif algo != a.Algo {\n\t\t\t\t\treturn nil, errors.Errorf(\"unexpected signing method: Expected %s Found %s\",\n\t\t\t\t\t\ta.Algo, algo)\n\t\t\t\t}\n\n\t\t\t\tswitch a.SigningMethod.(type) {\n\t\t\t\tcase *jwt.SigningMethodHMAC:\n\t\t\t\t\treturn []byte(a.VerificationKey), nil\n\t\t\t\tcase *jwt.SigningMethodRSA:\n\t\t\t\t\treturn a.RSAPublicKey, nil\n\t\t\t\t}\n\n\t\t\t\treturn nil, errors.Errorf(\"couldn't parse signing method from token header: %s\", algo)\n\t\t\t})\n\t}\n\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"unable to parse jwt token:%v\", err)\n\t}\n\n\tclaims, ok := token.Claims.(*CustomClaims)\n\tif !ok || !token.Valid {\n\t\treturn nil, errors.Errorf(\"claims in jwt token is not map claims\")\n\t}\n\n\tif err := claims.validateAudience(); err != nil {\n\t\treturn nil, err\n\t}\n\treturn claims, nil\n}\n","sourceCodeStart":389,"sourceCodeEnd":425,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/authorization/auth.go#L389-L425","documentation":"The token's alg header matched a.Algo, but a.SigningMethod is neither *jwt.SigningMethodHMAC nor *jwt.SigningMethodRSA, so the library does not know what key material to return to the verifier (it only supports HMAC symmetric keys and RSA public keys here). This means the SigningMethod field was set to an unsupported type (e.g. ECDSA) or left nil while Algo was set.","triggerScenarios":"In the static-key keyfunc: algo == a.Algo passes, then the type switch on a.SigningMethod matches neither *jwt.SigningMethodHMAC nor *jwt.SigningMethodRSA (nil or e.g. *jwt.SigningMethodECDSA), so the fallback errors.Errorf fires.","commonSituations":"AuthOptions.SigningMethod nil because only Algo was set; ECDSA keys used with a library path that only supports HMAC/RSA; SigningMethod assigned via reflection/config of wrong type; copy-paste from an example using a different algorithm family.","solutions":["Set SigningMethod to jwt.SigningMethodHS256 (HMAC) or jwt.SigningMethodRS256/RS384/RS512 (RSA) matching your keys.","If using ECDSA, switch keys to RSA or extend the switch to handle *jwt.SigningMethodECDSA and return the public key.","Ensure SigningMethod is never nil when Algo is set — validate at startup.","Verify VerificationKey (HMAC secret) or RSAPublicKey is populated for the chosen method.","Align a.Algo with the family of SigningMethod (RS256↔RSA, HS256↔HMAC)."],"exampleFix":"// before\nauth := &authorization.AuthOptions{ Algo: \"ES256\", VerificationKey: key }\n// after\nauth := &authorization.AuthOptions{ Algo: \"RS256\", SigningMethod: jwt.SigningMethodRS256, RSAPublicKey: pubKey }","handlingStrategy":"validation","validationCode":"func (a *AuthMeta) validateSigningConfig() error {\n    if len(a.JWKUrls) != 0 { return nil }\n    switch a.SigningMethod.(type) {\n    case *jwt.SigningMethodHMAC:\n        if a.VerificationKey == \"\" { return errors.New(\"HMAC chosen but VerificationKey empty\") }\n    case *jwt.SigningMethodRSA:\n        if a.RSAPublicKey == nil { return errors.New(\"RSA chosen but RSAPublicKey empty\") }\n    default:\n        return errors.New(\"SigningMethod must be HMAC or RSA\")\n    }\n    return nil\n}","typeGuard":"func supportedSigningMethod(m jwt.SigningMethod) bool {\n    switch m.(type) {\n    case *jwt.SigningMethodHMAC, *jwt.SigningMethodRSA:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := authCfg.validateSigningConfig(); err != nil {\n    log.Fatalf(\"unsupported signing configuration: %v\", err)\n}","preventionTips":["Only use HMAC or RSA signing methods with this library","Never leave SigningMethod nil when Algo is set","Add a startup assertion that SigningMethod and Algo families agree","Use typed construction helpers instead of raw struct literals for AuthOptions"],"tags":["jwt","configuration","signing-method","misconfiguration"],"backgroundTag":"unsupported-signing-method","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}