{"record":{"id":"d9a8e0089b354a20","repo":"BookStackApp/BookStack","slug":"failed-to-load-key-from-file-path-with-error-ex","errorCode":null,"errorMessage":"Failed to load key from file path with error: {$exception->getMessage()}","messagePattern":"Failed to load key from file path with error: (.+?)","errorType":"exception","errorClass":"OidcInvalidKeyException","httpStatus":null,"severity":"error","filePath":"app/Access/Oidc/OidcJwtSigningKey.php","lineNumber":43,"sourceCode":"            $this->loadFromJwkArray($jwkOrKeyPath);\n        } elseif (str_starts_with($jwkOrKeyPath, 'file://')) {\n            $this->loadFromPath($jwkOrKeyPath);\n        } else {\n            throw new OidcInvalidKeyException('Unexpected type of key value provided');\n        }\n    }\n\n    /**\n     * @throws OidcInvalidKeyException\n     */\n    protected function loadFromPath(string $path): void\n    {\n        try {\n            $key = PublicKeyLoader::load(\n                file_get_contents($path)\n            );\n        } catch (\\Exception $exception) {\n            throw new OidcInvalidKeyException(\"Failed to load key from file path with error: {$exception->getMessage()}\");\n        }\n\n        if (!$key instanceof RSA) {\n            throw new OidcInvalidKeyException('Key loaded from file path is not an RSA key as expected');\n        }\n\n        $this->key = $key->withPadding(RSA::SIGNATURE_PKCS1);\n    }\n\n    /**\n     * @throws OidcInvalidKeyException\n     */\n    protected function loadFromJwkArray(array $jwk): void\n    {\n        // 'alg' is optional for a JWK, but we will still attempt to validate if\n        // it exists otherwise presume it will be compatible.\n        $alg = $jwk['alg'] ?? null;\n        if ($jwk['kty'] !== 'RSA' || !(is_null($alg) || $alg === 'RS256')) {","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Oidc/OidcJwtSigningKey.php#L25-L61","documentation":"loadFromPath reads the file at the 'file://' path and hands the contents to phpseclib's PublicKeyLoader. If reading or parsing fails (unreadable file, missing file, malformed key), the underlying exception message is wrapped in OidcInvalidKeyException with this message.","triggerScenarios":"new OidcJwtSigningKey('file://...') where the path does not exist, is not readable (permissions), is empty, or contains data PublicKeyLoader cannot parse.","commonSituations":"Wrong path in config (relative vs absolute); file deployed without correct permissions; key file truncated or corrupted during deploy; unsupported key format (e.g. encrypted key without passphrase, or non-PEM blob).","solutions":["Verify the file exists and is readable by the PHP process (is_readable, ls -l, correct user/group)","Confirm the file contains a valid PEM key (openssl pkey -in key.pem -check)","Regenerate/replace a corrupted or empty key file","If the key is encrypted, provide the passphrase-compatible loader or decrypt it first"],"exampleFix":"// before (path typo / unreadable)\n$key = new OidcJwtSigningKey('file:///etc/oidc/key.pem');\n// after: verify then construct\nif (!is_readable('/etc/oidc/key.pem')) { throw new \\RuntimeException('key missing'); }\n$key = new OidcJwtSigningKey('file:///etc/oidc/key.pem');","handlingStrategy":"try-catch","validationCode":"$path = substr($value, strlen('file://'));\nif (!is_file($path) || !is_readable($path)) { throw new \\RuntimeException(\"key file missing or unreadable: $path\"); }\nopenssl_pkey_get_public('file://' . $path) ?: throw new \\RuntimeException('unparseable key file');","typeGuard":null,"tryCatchPattern":"try { $key = new OidcJwtSigningKey('file://' . $path); } catch (OidcInvalidKeyException $e) { log_error($e->getMessage()); throw $e; } // message includes underlying loader error","preventionTips":["Deploy key files with correct ownership/permissions for the PHP user","Verify key PEM validity in CI (openssl pkey -check)","Use absolute paths and confirm them in the deployment environment","Never ship empty or placeholder key files"],"tags":["php","oidc","key-loading","filesystem"],"backgroundTag":"invalid-signing-key","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}