{"record":{"id":"ce80a6d445d50ecc","repo":"gofr-dev/gofr","slug":"token-file-is-empty","errorCode":null,"errorMessage":"token file is empty","messagePattern":"token file is empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/service/file_token_auth.go","lineNumber":24,"sourceCode":"\t\"fmt\"\n\t\"net/http\"\n\t\"os\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"gofr.dev/pkg/gofr/logging\"\n)\n\nconst (\n\t// DefaultTokenFilePath is the standard Kubernetes projected service account token mount path.\n\tDefaultTokenFilePath = \"/var/run/secrets/kubernetes.io/serviceaccount/token\" // #nosec G101 -- file path, not a credential\n\n\tdefaultRefreshInterval = 30 * time.Second\n)\n\nvar (\n\terrEmptyTokenFile    = errors.New(\"token file is empty\")\n\terrTokenUnavailable  = errors.New(\"no token available\")\n\terrAuthHeaderPresent = errors.New(\"authorization header already set on request\")\n)\n\n// FileTokenAuthConfig reads a bearer token from a local file and periodically\n// re-reads it to support token rotation (e.g. Kubernetes projected service\n// account tokens).\n//\n// The returned value implements Options, Observable and\n// io.Closer. Call Close to stop the background refresh goroutine; it is safe\n// to call Close multiple times.\ntype FileTokenAuthConfig struct {\n\ttokenFilePath   string\n\trefreshInterval time.Duration\n\n\tlogger logging.Logger\n\n\tmu    sync.RWMutex","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/service/file_token_auth.go#L6-L42","documentation":"errEmptyTokenFile is returned by readToken in pkg/gofr/service/file_token_auth.go:24 when the bearer-token file (default /var/run/secrets/kubernetes.io/serviceaccount/token) exists but its contents are empty after trimming whitespace. FileTokenAuthConfig reads the token eagerly at construction so misconfiguration fails at startup rather than on the first upstream call, and a service-account token can never legitimately be blank.","triggerScenarios":"Calling NewFileTokenAuthConfig (or any options wrapper) when the file at tokenFilePath exists but contains only whitespace/an empty string; also raised by the background refreshLoop and logged as a WARN when the projected volume empties mid-run.","commonSituations":"Mounting the Kubernetes projected service-account token with an unset serviceAccountToken audience/path so the file is created empty; pointing WithTokenFilePath at a manually created placeholder file; a secret or volume that has been truncated by a failed rotation; running locally outside K8s with an empty stub file.","solutions":["Ensure the token file actually contains a service-account JWT (cat the path; it must be non-empty) and that the pod mounts the projected volume correctly.","If the path is wrong, pass WithTokenFilePath(\"/correct/path/token\") to NewFileTokenAuthConfig.","If a failed rotation truncated the file, remount/recreate the projected volume (or restart the pod) so kubelet rewrites the token.","In local/dev environments, generate a real token file instead of an empty stub."],"exampleFix":"// before\nf, err := service.NewFileTokenAuthConfig() // empty /var/run/.../token outside K8s\n// after\nf, err := service.NewFileTokenAuthConfig(service.WithTokenFilePath(\"/tmp/dev-sa-token\"))","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(tokenPath)\nif err != nil { return err }\nif len(strings.TrimSpace(string(data))) == 0 { return errors.New(\"token file is empty: \" + tokenPath) }","typeGuard":"func hasToken(path string) bool {\n\tb, err := os.ReadFile(path)\n\treturn err == nil && len(strings.TrimSpace(string(b))) > 0\n}","tryCatchPattern":null,"preventionTips":["Verify the projected service-account token volume is mounted before starting the service.","Stat/read the token path in a readiness probe or startup check.","Never create placeholder empty token files in dev; generate a real JWT.","Watch the config's WARN refresh logs to catch a file that empties mid-run."],"tags":["kubernetes","auth","file-io","config"],"backgroundTag":"empty-credential-file","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}