{"record":{"id":"c0b85debadb7fa79","repo":"crowdsecurity/crowdsec","slug":"authmiddleware-middlewareinit-error","errorCode":null,"errorMessage":"authMiddleware.MiddlewareInit() Error:","messagePattern":"authMiddleware\\.MiddlewareInit\\(\\) Error:","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":315,"sourceCode":"\t\tTimeout:         time.Hour,\n\t\tMaxRefresh:      time.Hour,\n\t\tIdentityKey:     MachineIDKey,\n\t\tPayloadFunc:     PayloadFunc,\n\t\tIdentityHandler: IdentityHandler,\n\t\tAuthenticator:   jwtMiddleware.Authenticator,\n\t\tAuthorizator:    Authorizator,\n\t\tUnauthorized:    Unauthorized,\n\t\tTokenLookup:     \"header: Authorization, cookie: jwt\",\n\t\tTokenHeadName:   \"Bearer\",\n\t\tTimeFunc:        time.Now,\n\t})\n\tif err != nil {\n\t\treturn &JWT{}, err\n\t}\n\n\terrInit := ret.MiddlewareInit()\n\tif errInit != nil {\n\t\treturn &JWT{}, errors.New(\"authMiddleware.MiddlewareInit() Error:\" + errInit.Error())\n\t}\n\n\tjwtMiddleware.Middleware = ret\n\n\treturn jwtMiddleware, nil\n}\n","sourceCodeStart":297,"sourceCodeEnd":322,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L297-L322","documentation":"NewJWT constructs the JWT auth middleware and then calls MiddlewareInit() to load/validate its configuration (signing key, discovery, etc.). If initialization fails, the constructor wraps the underlying error with the 'authMiddleware.MiddlewareInit() Error:' prefix and returns a zero-value JWT, so the API server cannot start with JWT auth.","triggerScenarios":"NewJWT (called from NewMiddlewares at apiserver startup) when MiddlewareInit fails, e.g. the jwt secret in the local API server config is empty/absent or the underlying middleware init returns an error.","commonSituations":"api section of crowdsec config (dev.yaml / config.yaml) has an empty or missing api.server.jwt_secret; corrupted or hand-edited config file; fresh installs where LAPI secret registration failed.","solutions":["Generate or set a jwt_secret in the api.server config section (cscli can regenerate it, or copy a known-good config)","Inspect the wrapped inner message after the prefix to see the actual init failure","Re-run the CrowdSec install/config wizard or restore the config from backup","Check file permissions/ownership of the config and secrets directory"],"exampleFix":"// before (config.yaml)\napi:\n  server:\n    jwt_secret: \"\"\n// after\napi:\n  server:\n    jwt_secret: \"<generated-64-char-random-string>\"","handlingStrategy":"validation","validationCode":"// before starting the API server, check the secret exists\nif cfg.API.Server.JWTSecret == \"\" {\n    return fmt.Errorf(\"api.server.jwt_secret is empty; generate one before starting\")\n}","typeGuard":null,"tryCatchPattern":"// startup code\njwt, err := NewJWT(cfg)\nif err != nil {\n    log.Fatalf(\"jwt middleware init failed: %v\", err)\n}","preventionTips":["Never hand-edit jwt_secret to empty; use cscli/config tooling to generate it","Keep config templates with generated defaults, not empty strings","Log the inner error, not just the wrapper prefix, when debugging"],"tags":["jwt","config","middleware","apiserver"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}