{"record":{"id":"bf5e6f013c312a35","repo":"Pumpkin-MC/Pumpkin","slug":"json-parse-error-0","errorCode":null,"errorMessage":"JSON parse error: {0}","messagePattern":"JSON parse error: (.+?)","errorType":"error_code","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-auth/src/jwt/mod.rs","lineNumber":42,"sourceCode":"    pub uuid: String,\n    /// The player's Xbox User ID (XUID).\n    pub xuid: String,\n}\n\n/// Represents the possible errors that can occur during JWT verification.\n#[derive(Debug, Error)]\npub enum AuthError {\n    /// Indicates that a JWT token has an invalid format (not enough parts).\n    #[error(\"Invalid token format\")]\n    InvalidTokenFormat,\n    /// Indicates that the 'x5u' (X.509 URL) header parameter is missing from a token.\n    #[error(\"x5u not found in header\")]\n    MissingX5U,\n    /// Indicates a failure in Base64 decoding.\n    #[error(\"Base64 decoding failed: {0}\")]\n    Base64Decode(#[from] base64::DecodeError),\n    /// Indicates a failure in parsing JSON data.\n    #[error(\"JSON parse error: {0}\")]\n    JsonParse(#[from] serde_json::Error),\n    /// Indicates a failure in building a public key from its representation.\n    #[error(\"Public key build failed: {0}\")]\n    PublicKeyBuild(String),\n    /// Indicates that the token was not signed by the trusted Mojang public key.\n    #[error(\"Token not signed by trusted Mojang key\")]\n    MojangKeyMismatch,\n    /// Indicates that the token's signature is invalid.\n    #[error(\"Invalid signature\")]\n    InvalidSignature,\n    /// Indicates an error related to ECDSA signature operations.\n    #[error(\"ECDSA signature error: {0}\")]\n    Ecdsa(#[from] ecdsa::Error),\n}\n\n/// Decodes a Base64 URL-safe encoded string with no padding.\n///\n/// # Arguments","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-auth/src/jwt/mod.rs#L24-L60","documentation":"This error is produced by the JWT error enum in pumpkin-auth when parsing JSON data fails during Minecraft Web/Telemetry-style token (Mojang public key / profile key) verification. It wraps serde_json::Error via #[from], so any serde deserialization failure on a JWT header or payload surfaces as this variant. It typically means the token segments are not valid JSON after Base64 decoding.","triggerScenarios":"Calling JWT parsing/verification functions (e.g. decoding a player's public key token) where the Base64-decoded header or claims string is malformed JSON: truncated tokens, clients sending corrupted or hand-crafted tokens, or decoding the wrong segment.","commonSituations":"Modified or hacked clients sending malformed chat/session tokens; proxy software mangling token payloads; treating non-JSON strings (raw binary or double-encoded Base64) as token segments.","solutions":["Log the underlying serde_json::Error source (use {:?} or the source chain) to see the exact parse failure location","Reject the connection: this token is untrustworthy, so return the auth failure to the client instead of retrying","Verify you are decoding the correct JWT segment (header/payload) with URL-safe Base64 without padding before JSON parsing","Confirm the client is a legitimate Minecraft client version; malformed tokens usually indicate tampering or a broken proxy"],"exampleFix":"// before\nlet claims: PlayerClaims = serde_json::from_slice(&decoded)?;\n// after\nlet claims: PlayerClaims = serde_json::from_slice(&decoded).map_err(|e| {\n    log::warn!(\" rejecting client: invalid token JSON: {e}\");\n    AuthError::JsonParse(e)\n})?;","handlingStrategy":"try-catch","validationCode":"// validate token shape before parsing\nfn token_segments_look_valid(token: &str) -> bool {\n    let parts: Vec<&str> = token.split('.').collect();\n    parts.len() == 3 && parts.iter().take(2).all(|p| !p.is_empty())\n}","typeGuard":"fn is_valid_jwt_shape(token: &str) -> bool {\n    token.split('.').count() == 3\n}","tryCatchPattern":"match jwt::parse(&token) {\n    Err(jwt::Error::JsonParse(e)) => {\n        log::warn!(\"malformed token JSON, rejecting client: {e}\");\n        // disconnect client\n    }\n    r => r?,\n}","preventionTips":["Validate the JWT has exactly three non-empty dot-separated segments before parsing","Decode with URL-safe Base64 (no padding) before JSON parsing","Log the serde source error to diagnose format drift quickly","Treat malformed tokens as untrusted input and reject, never retry"],"tags":["jwt","serde","json","authentication","rust"],"backgroundTag":"json-parse-error","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}