{"record":{"id":"d5119c13bfbe4eb3","repo":"kgretzky/evilginx2","slug":"auth-tokens-path-not-found-for-body-auth-token","errorCode":null,"errorMessage":"auth_tokens: 'path' not found for body auth token","messagePattern":"auth_tokens: 'path' not found for body auth token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":550,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for cookie auth token\")\n\t\t\t}\n\t\t\tif at.Keys == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'keys' not found for cookie auth token\")\n\t\t\t}\n\n\t\t\tfor n := range *at.Keys {\n\t\t\t\t(*at.Keys)[n] = p.paramVal((*at.Keys)[n])\n\t\t\t}\n\t\t\terr := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"body\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Name == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'name' not found for body auth token\")\n\t\t\t}\n\t\t\tif at.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'search' not found for body auth token\")\n\t\t\t}\n\n\t\t\terr := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase \"http\":\n\t\t\tif at.Domain == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'domain' not found for http auth token\")\n\t\t\t}\n\t\t\tif at.Path == nil {\n\t\t\t\treturn fmt.Errorf(\"auth_tokens: 'path' not found for http auth token\")","sourceCodeStart":532,"sourceCodeEnd":568,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L532-L568","documentation":"This error is thrown when a `body`-type entry in a phishlet's `auth_tokens` section defines `domain` but omits the required `path` field. The path is a regular expression identifying which response endpoint the token is extracted from; without it the entry cannot be matched and the phishlet fails to load.","triggerScenarios":"An auth_tokens entry with `type: body` has `domain` (and possibly `name`/`search`) but no `path:` line.","commonSituations":"Incomplete body token entry; removing the path while editing; YAML indentation errors so `path` falls into the previous entry.","solutions":["Add a `path` field with a valid regular expression to the body auth token entry (e.g. `path: ^/api/login$`).","Verify the regex compiles under Go RE2 syntax to avoid the follow-up invalid-regular-expression error.","Confirm `path` is indented within the same auth_tokens list item as `domain`."],"exampleFix":"// before (phishlet.yml)\nauth_tokens:\n  - type: body\n    domain: api\n    name: token\n    search: 'token=([A-Za-z0-9]+)'\n// after\nauth_tokens:\n  - type: body\n    domain: api\n    path: ^/api/login$\n    name: token\n    search: 'token=([A-Za-z0-9]+)'","handlingStrategy":"validation","validationCode":"import \"regexp\"\n\nfor i, at := range cfg.AuthTokens {\n    if at.Type != nil && *at.Type == \"body\" {\n        if at.Path == nil {\n            return fmt.Errorf(\"auth_tokens[%d]: 'path' not found for body auth token\", i)\n        }\n        if _, err := regexp.Compile(*at.Path); err != nil {\n            return fmt.Errorf(\"auth_tokens[%d]: invalid path regex: %v\", i, err)\n        }\n    }\n}","typeGuard":"func bodyTokenHasValidPath(at AuthToken) bool {\n    if at.Path == nil {\n        return false\n    }\n    _, err := regexp.Compile(*at.Path)\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Pre-compile the path regex in a test to verify it is valid RE2.","Keep the path anchored (^...$) to the exact endpoint that returns the token.","Check list indentation so `path` sits inside the correct body token entry."],"tags":["phishlet","configuration","auth-tokens","yaml-validation"],"backgroundTag":"missing-required-argument","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}