{"record":{"id":"bb35c4d890ac5ebe","repo":"gofr-dev/gofr","slug":"require-non-empty-provider","errorCode":null,"errorMessage":"require non-empty provider","messagePattern":"require non-empty provider","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/oauth.go","lineNumber":22,"sourceCode":"\t\"context\"\n\t\"crypto/rsa\"\n\t\"encoding/base64\"\n\t\"encoding/json\"\n\t\"errors\"\n\t\"fmt\"\n\t\"io\"\n\t\"math/big\"\n\t\"net/http\"\n\t\"regexp\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/golang-jwt/jwt/v5\"\n)\n\nvar (\n\terrEmptyProvider       = errors.New(\"require non-empty provider\")\n\terrInvalidInterval     = errors.New(\"invalid interval, require a value greater than 1 second\")\n\terrEmptyModulus        = errors.New(\"modulus is empty\")\n\terrEmptyPublicExponent = errors.New(\"public exponent is empty\")\n\terrEmptyResponseBody   = errors.New(\"response body is empty\")\n\terrInvalidURL          = errors.New(\"invalid URL\")\n)\n\nconst jwtRegexPattern = \"^[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+$\"\n\n// PublicKeys stores a map of public keys identified by their key ID (kid).\ntype PublicKeys struct {\n\tmu   sync.RWMutex\n\tkeys map[string]*rsa.PublicKey\n}\n\n// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).\ntype JWKNotFound struct {\n}","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/oauth.go#L4-L40","documentation":"errEmptyProvider is a sentinel in GoFr's OAuth middleware returned by NewOAuthProvider (and helpers like ExtractAuthHeader/getPublicKeyFunc paths that validate inputs). It is returned when the OAuth provider name (e.g. the JWKS/issuer identifier used to fetch public keys) is an empty string. Without a provider the middleware cannot discover signing keys or validate JWTs.","triggerScenarios":"Calling NewOAuthProvider(\"\") or otherwise leaving the provider argument unset; the same guard is enforced when extracting auth headers or resolving public keys with no provider configured.","commonSituations":"OAuth provider name read from an env var or config key that is unset, YAML key renamed during migration, or copy-pasted setup code omitting the provider argument.","solutions":["Pass a non-empty provider name/URL to NewOAuthProvider","Verify the config/env var that supplies the provider value is set at startup","Fail fast with a startup check: if provider == \"\" return a fatal config error","Review OAuth middleware setup order so the provider is resolved before the middleware is registered"],"exampleFix":"// before\nprovider := os.Getenv(\"OAUTH_PROVIDER\") // \"\"\noauth, err := middleware.NewOAuthProvider(provider, interval) // errEmptyProvider\n// after\nprovider := os.Getenv(\"OAUTH_PROVIDER\")\nif provider == \"\" { log.Fatal(\"OAUTH_PROVIDER is required\") }\noauth, err := middleware.NewOAuthProvider(provider, interval)","handlingStrategy":"validation","validationCode":"if provider == \"\" {\n    return errors.New(\"OAUTH provider must be set before constructing the OAuth middleware\")\n}","typeGuard":"func providerConfigured(p string) bool { return strings.TrimSpace(p) != \"\" }","tryCatchPattern":"oauth, err := middleware.NewOAuthProvider(provider, interval)\nif err != nil {\n    if errors.Is(err, middleware.ErrEmptyProvider) {\n        log.Fatal(\"oauth provider name missing in configuration\")\n    }\n    return err\n}","preventionTips":["Assert required OAuth config values at application startup","Use typed config structs with required-field validation","Never pass env-derived strings straight into constructors without an empty check","Document required OAuth env vars in deployment manifests"],"tags":["oauth","jwt","config","gofr"],"backgroundTag":"missing-oauth-provider","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}