{"record":{"id":"da9c5790a8813668","repo":"ory/kratos","slug":"could-not-decode-schema-file-w","errorCode":null,"errorMessage":"could not decode schema file: %w","messagePattern":"could not decode schema file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"schema/handler.go","lineNumber":241,"sourceCode":"\n\tx.PaginationHeader(w, *r.URL, int64(total), page, itemsPerPage)\n\th.r.Writer().Write(w, r, ss)\n}\n\nfunc (h *Handler) ReadSchema(ctx context.Context, uri *url.URL) (data []byte, err error) {\n\tctx, span := h.r.Tracer(ctx).Tracer().Start(ctx, \"schema.Handler.ReadSchema\")\n\tdefer otelx.End(span, &err)\n\n\tswitch uri.Scheme {\n\tcase \"file\":\n\t\tdata, err = os.ReadFile(uri.Host + uri.Path) //nolint:gosec\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(fmt.Errorf(\"could not read schema file: %w\", err))\n\t\t}\n\tcase \"base64\":\n\t\tdata, err = base64.StdEncoding.DecodeString(strings.TrimPrefix(uri.String(), \"base64://\"))\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(fmt.Errorf(\"could not decode schema file: %w\", err))\n\t\t}\n\tdefault:\n\t\treq, err := retryablehttp.NewRequestWithContext(ctx, http.MethodGet, uri.String(), nil)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(fmt.Errorf(\"could not create request: %w\", err))\n\t\t}\n\t\tresp, err := h.r.HTTPClient(ctx).Do(req)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(herodot.ErrUpstreamError().WithReason(\"could not fetch schema\").WithError(err.Error()).WithDetail(\"uri\", uri))\n\t\t}\n\t\tdefer func() { _ = resp.Body.Close() }()\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\tif resp.StatusCode == http.StatusNotFound {\n\t\t\t\treturn nil, herodot.ErrNotFound().WithDetail(\"url\", uri)\n\t\t\t}\n\t\t\treturn nil, errors.WithStack(herodot.ErrUpstreamError().WithError(\"upstream error\").WithDetail(\"status_code\", resp.StatusCode).WithDetail(\"uri\", uri))\n\t\t}\n\t\tdata, err = io.ReadAll(io.LimitReader(resp.Body, maxSchemaSize))","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/schema/handler.go#L223-L259","documentation":"ReadSchema supports base64:// URIs whose payload is base64-encoded schema JSON. If base64.StdEncoding.DecodeString fails (invalid characters, wrong padding), the error is wrapped as \"could not decode schema file\".","triggerScenarios":"Schema URI starting with base64:// whose remainder is not valid standard base64 — e.g. whitespace/newlines inside, URL-safe base64 (- and _) instead of standard, missing padding, or truncated data.","commonSituations":"Encoding with RawURLEncoding or URL-safe base64 then pasting into config; copy-paste introducing line breaks; hand-editing the base64 blob; using base64 output that includes the 'data:...;base64,' prefix.","solutions":["Re-encode the schema with standard base64 (echo -n '...' | base64) and no line wrapping","Strip any whitespace/newlines from the base64 payload","Remove a 'data:application/json;base64,' prefix if present — keep only base64:// + payload","Convert URL-safe base64 (-, _) to standard (+, /) and restore padding","Alternatively switch to a file:// or http(s):// schema URI"],"exampleFix":"// before\nschema: \"base64://e30j\"\n// after\nschema: \"base64://e30=\"","handlingStrategy":"validation","validationCode":"// Go: preflight a base64:// schema URI\nfunc base64SchemaDecodable(raw string) error {\n\tif !strings.HasPrefix(raw, \"base64://\") {\n\t\treturn nil\n\t}\n\tpayload := strings.TrimPrefix(raw, \"base64://\")\n\tdata, err := base64.StdEncoding.DecodeString(payload)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"schema payload is not standard base64: %w\", err)\n\t}\n\treturn json.Unmarshal(data, &map[string]interface{}{})\n}","typeGuard":"func isStdBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil\n}","tryCatchPattern":"schema, err := h.ReadSchema(ctx, uri)\nif err != nil {\n\tif base64.CorruptInputError(0) != nil && strings.Contains(err.Error(), \"could not decode\") {\n\t\treturn fmt.Errorf(\"re-encode schema with `base64` (standard, no wrapping): %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Generate the payload with `base64 -w0` (no line wrapping)","Never use URL-safe base64 for base64:// URIs","Strip data-URI prefixes and whitespace before embedding","Validate the decoded output is valid JSON before deploying"],"tags":["schema","base64","encoding","configuration"],"backgroundTag":"invalid-argument-format","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}