{"record":{"id":"bc49ed03711c30ea","repo":"kgretzky/evilginx2","slug":"auth-tokens-header-not-found-for-http-auth-toke","errorCode":null,"errorMessage":"auth_tokens: 'header' not found for http auth token","messagePattern":"auth_tokens: 'header' not found for http auth token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":574,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'search' not found for body auth token\")\n\t\t\t}\n\n\t\t\terr := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"http\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Header == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'header' not found for http auth token\")\n\t\t\t}\n\n\t\t\terr := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tfor _, au := range fp.AuthUrls {\n\t\tre, err := regexp.Compile(p.paramVal(au))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tp.authUrls = append(p.authUrls, re)\n\t}\n\n\tif fp.Credentials.Username.Key == nil {\n\t\treturn fmt.Errorf(\"credentials: missing username `key` field\")","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L556-L592","documentation":"Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'header' field. 'header' specifies which HTTP header carries the token; without it the library cannot inject or extract the token, so the phishlet is rejected.","triggerScenarios":"An http auth_tokens entry sets domain/path/name but omits 'header', or 'header' is misspelled/indented outside the entry.","commonSituations":"Writing a phishlet for an API target and forgetting the header key; assuming 'name' doubles as the header name (it does not); partial edits removing the header line.","solutions":["Add a 'header:' field with the actual HTTP header name (e.g. Authorization)","Verify indentation groups 'header' with the same list item as 'type: http'","Test the phishlet load after the fix"],"exampleFix":"// before\n  - type: http\n    domain: '.example.com'\n    path: '/'\n    name: authz\n// after\n  - type: http\n    domain: '.example.com'\n    path: '/'\n    name: authz\n    header: Authorization","handlingStrategy":"validation","validationCode":"for i, at := range cfg.AuthTokens {\n  if at.Type == \"http\" && (at.Header == nil || *at.Header == \"\") {\n    return fmt.Errorf(\"auth_tokens[%d]: http token missing 'header'\", i)\n  }\n}","typeGuard":"func hasHeader(at AuthToken) bool { return at.Header != nil && *at.Header != \"\" }","tryCatchPattern":null,"preventionTips":["Record the actual HTTP header name from the target site before writing the phishlet","Keep name and header fields together","Validate phishlets in CI"],"tags":["phishlet","config","yaml","validation"],"backgroundTag":"phishlet-schema-validation","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}