{"record":{"id":"d98f4ca3437149b2","repo":"cube-js/cube","slug":"e-tostring","errorCode":null,"errorMessage":"e.toString()","messagePattern":"e\\.toString\\(\\)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"packages/cubejs-api-gateway/src/gateway.ts","lineNumber":2868,"sourceCode":"        const error = e.originalError || e;\n        const stack = getEnv('devMode') ? error.stack : undefined;\n        this.log({\n          type: error.message,\n          url: req.url,\n          token,\n          error: stack || error.toString()\n        }, <any>req);\n\n        res.status(e.status).json({ error: e.message });\n      } else if (e instanceof Error) {\n        const stack = getEnv('devMode') ? e.stack : undefined;\n        this.log({\n          type: 'Auth Error',\n          token,\n          error: stack || e.toString()\n        }, <any>req);\n\n        res.status(500).json({\n          error: e.toString(),\n          stack,\n        });\n      }\n    }\n  }\n\n  protected checkAuth: RequestHandler = async (req, res, next) => {\n    await this.checkAuthWrapper(this.checkAuthFn, req, res, next);\n  };\n\n  protected checkAuthSystemMiddleware: RequestHandler = async (req, res, next) => {\n    await this.checkAuthWrapper(this.checkAuthSystemFn, req, res, next);\n  };\n\n  protected requestContextMiddleware: RequestHandler = async (req: Request, res: ExpressResponse, next: NextFunction) => {\n    try {\n      req.context = await this.contextByReq(req, req.securityContext, getRequestIdFromRequest(req));","sourceCodeStart":2850,"sourceCodeEnd":2886,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-api-gateway/src/gateway.ts#L2850-L2886","documentation":"In the API Gateway auth error path (packages/cubejs-api-gateway/src/gateway.ts:2868), when token authorization throws an unexpected error, the handler logs 'Auth Error' and responds 500 with { error: e.toString(), stack }. The thrown value's stringification is surfaced verbatim to the client, which usually indicates a non-Error throw or a misconfigured JWT secret/checker rather than a normal 401 auth rejection.","triggerScenarios":"A request with an auth token where the token check throws — e.g. jwt.verify failing with a non-standard error, a custom checkAuth function throwing, or a wrong/malformed CUBEJS_API_SECRET causing an exception in the auth path.","commonSituations":"Mismatched JWT signing secret between client and Cube; expired/malformed tokens handled by custom auth code that throws; auth functions written async but consumed synchronously, causing unhandled rejections surfacing here.","solutions":["Check the returned `error`/`stack` in the 500 body to identify the underlying exception","Verify the client's JWT is signed with the same secret as CUBEJS_API_SECRET and uses a supported algorithm","Make any custom checkAuth/securityContext functions throw standard Errors and return 401 for auth failures instead of letting exceptions escape","Regenerate/reissue tokens if the secret was rotated"],"exampleFix":"// before (custom auth that throws)\ncheckAuth: (req, auth) => { if (!auth) throw new Error('no auth'); }\n// after\ncheckAuth: async (req, auth) => { if (!auth) throw new AuthenticationError('no auth'); }","handlingStrategy":"try-catch","validationCode":"function isWellFormedJwt(token) {\n  return typeof token === 'string' && token.split('.').length === 3;\n}","typeGuard":"function isAuthError(e: unknown): e is Error {\n  return e instanceof Error && 'name' in e;\n}","tryCatchPattern":"// client-side\ntry {\n  const res = await cubejsApi.load(query);\n} catch (e) {\n  if (e?.response?.status === 500 && e.response.data?.error) {\n    console.error('Auth path threw:', e.response.data.error, e.response.data.stack);\n  }\n}","preventionTips":["Ensure client JWTs are signed with the same secret/algorithm as CUBEJS_API_SECRET","Have custom checkAuth/securityContext hooks throw standard Errors and map auth failures to 401","Rotate and redeploy secrets atomically so old tokens fail with clear errors, not exceptions","Log the stack field from the 500 body to pinpoint the throwing auth code"],"tags":["auth","jwt","api-gateway","http-500"],"backgroundTag":"auth-error-500","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}