{"record":{"id":"d7df1110c9ade40e","repo":"gofr-dev/gofr","slug":"public-exponent-is-empty","errorCode":null,"errorMessage":"public exponent is empty","messagePattern":"public exponent is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/oauth.go","lineNumber":25,"sourceCode":"\t\"encoding/json\"\n\t\"errors\"\n\t\"fmt\"\n\t\"io\"\n\t\"math/big\"\n\t\"net/http\"\n\t\"regexp\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/golang-jwt/jwt/v5\"\n)\n\nvar (\n\terrEmptyProvider       = errors.New(\"require non-empty provider\")\n\terrInvalidInterval     = errors.New(\"invalid interval, require a value greater than 1 second\")\n\terrEmptyModulus        = errors.New(\"modulus is empty\")\n\terrEmptyPublicExponent = errors.New(\"public exponent is empty\")\n\terrEmptyResponseBody   = errors.New(\"response body is empty\")\n\terrInvalidURL          = errors.New(\"invalid URL\")\n)\n\nconst jwtRegexPattern = \"^[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+\\\\.[A-Za-z0-9-_]+$\"\n\n// PublicKeys stores a map of public keys identified by their key ID (kid).\ntype PublicKeys struct {\n\tmu   sync.RWMutex\n\tkeys map[string]*rsa.PublicKey\n}\n\n// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).\ntype JWKNotFound struct {\n}\n\nfunc (JWKNotFound) Error() string {\n\treturn \"JWKS Not Found\"","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/oauth.go#L7-L43","documentation":"errEmptyPublicExponent is returned by rsaPublicKey in the OAuth2/JWT middleware when a JWKS entry lacks a public exponent (the 'e' field of the RSA JWK). The middleware needs modulus and exponent to reconstruct the RSA public key used to verify JWT signatures. An empty exponent means the identity provider's key set entry is malformed or was parsed incorrectly.","triggerScenarios":"Calling getPublicKeys/rsaPublicKey against a JWKS endpoint whose keys omit the 'e' field; the identity provider returns a non-RSA key type (e.g. EC) where 'e' is absent; a truncated or hand-crafted JWKS JSON response in tests.","commonSituations":"Misconfigured OIDC provider exposing non-RSA signing keys; a proxy returning cached/partial JWKS; tests feeding fake JWKS bodies without the exponent field.","solutions":["Verify the identity provider publishes RSA keys (kty=rsa) with both 'n' (modulus) and 'e' (exponent) in its JWKS","Check that the correct JWKS URL is configured for the provider (wrong provider can yield keys without 'e')","Fix the JWKS fixture/test data to include the 'e' field (typically 'AQAB')"],"exampleFix":"// before\n{\"kty\":\"RSA\",\"n\":\"x base64url modulus\"}\n// after\n{\"kty\":\"RSA\",\"n\":\"x base64url modulus\",\"e\":\"AQAB\"}","handlingStrategy":"validation","validationCode":"for _, k := range jwks.Keys { if k.Kty == \"RSA\" && (k.E == \"\" || k.N == \"\") { return fmt.Errorf(\"JWKS key %s missing n/e\", k.Kid) } }","typeGuard":"func hasRSAExponent(k JWK) bool { return k.Kty == \"RSA\" && k.E != \"\" && k.N != \"\" }","tryCatchPattern":null,"preventionTips":["Verify your IdP publishes RSA (kty=rsa) keys with n and e in its JWKS","Pin the correct JWKS/certs URL for your provider","Add a startup health check that fetches and validates the JWKS"],"tags":["oauth","jwt","jwks","rsa"],"backgroundTag":"jwks-key-parsing-failed","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}