{"record":{"id":"c737d87cf7d2633b","repo":"vxcontrol/pentagi","slug":"unexpected-signing-method-v","errorCode":null,"errorMessage":"unexpected signing method: %v","messagePattern":"unexpected signing method: (.+?)","errorType":"validation","errorClass":null,"httpStatus":401,"severity":"error","filePath":"backend/pkg/server/auth/api_token_jwt.go","lineNumber":43,"sourceCode":"\treturn models.APITokenClaims{\n\t\tTokenID: tokenID,\n\t\tRID:     rid,\n\t\tUID:     uid,\n\t\tUHASH:   uhash,\n\t\tRegisteredClaims: jwt.RegisteredClaims{\n\t\t\tExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(ttl) * time.Second)),\n\t\t\tIssuedAt:  jwt.NewNumericDate(now),\n\t\t\tSubject:   \"api_token\",\n\t\t},\n\t}\n}\n\nfunc ValidateAPIToken(tokenString, globalSalt string) (*models.APITokenClaims, error) {\n\tvar claims models.APITokenClaims\n\ttoken, err := jwt.ParseWithClaims(tokenString, &claims, func(token *jwt.Token) (any, error) {\n\t\t// verify signing algorithm to prevent \"alg: none\"\n\t\tif _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {\n\t\t\treturn nil, fmt.Errorf(\"unexpected signing method: %v\", token.Header[\"alg\"])\n\t\t}\n\t\treturn MakeJWTSigningKey(globalSalt), nil\n\t})\n\tif err != nil {\n\t\tif errors.Is(err, jwt.ErrTokenMalformed) {\n\t\t\treturn nil, fmt.Errorf(\"token is malformed\")\n\t\t} else if errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet) {\n\t\t\treturn nil, fmt.Errorf(\"token is either expired or not active yet\")\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"token invalid: %w\", err)\n\t\t}\n\t}\n\n\tif !token.Valid {\n\t\treturn nil, fmt.Errorf(\"token is invalid\")\n\t}\n\n\treturn &claims, nil","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/auth/api_token_jwt.go#L25-L61","documentation":"Error \"unexpected signing method: %v\" thrown in vxcontrol/pentagi.","triggerScenarios":"Thrown at backend/pkg/server/auth/api_token_jwt.go:43 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}