{"record":{"id":"e3f51707b35833f9","repo":"Tencent/WeKnora","slug":"unexpected-id-token-signing-method-v","errorCode":null,"errorMessage":"unexpected id_token signing method: %v","messagePattern":"unexpected id_token signing method: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1958,"sourceCode":") (map[string]interface{}, error) {\n\tif strings.TrimSpace(cfg.JwksURI) == \"\" {\n\t\treturn nil, errors.New(\"cannot verify OIDC id_token: no jwks_uri configured\")\n\t}\n\tif strings.TrimSpace(cfg.IssuerURL) == \"\" {\n\t\treturn nil, errors.New(\"cannot verify OIDC id_token: issuer is not configured\")\n\t}\n\tif strings.TrimSpace(cfg.ClientID) == \"\" {\n\t\treturn nil, errors.New(\"cannot verify OIDC id_token: client_id is not configured\")\n\t}\n\n\tjwks, err := s.fetchOIDCJWKS(ctx, cfg.JwksURI)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeyFunc := func(token *jwt.Token) (interface{}, error) {\n\t\tif _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {\n\t\t\treturn nil, fmt.Errorf(\"unexpected id_token signing method: %v\", token.Header[\"alg\"])\n\t\t}\n\t\tkid, _ := token.Header[\"kid\"].(string)\n\t\treturn jwks.rsaKeyForKid(kid)\n\t}\n\n\tclaims := jwt.MapClaims{}\n\tif _, err := jwt.NewParser(\n\t\tjwt.WithValidMethods([]string{\"RS256\", \"RS384\", \"RS512\"}),\n\t\tjwt.WithExpirationRequired(),\n\t\tjwt.WithLeeway(oidcIDTokenLeeway),\n\t\tjwt.WithIssuer(strings.TrimSpace(cfg.IssuerURL)),\n\t\tjwt.WithAudience(strings.TrimSpace(cfg.ClientID)),\n\t).ParseWithClaims(idToken, claims, keyFunc); err != nil {\n\t\treturn nil, fmt.Errorf(\"id_token verification failed: %w\", err)\n\t}\n\tverified := map[string]interface{}(claims)\n\tif strings.TrimSpace(extractClaimAsString(verified, \"sub\")) == \"\" {\n\t\treturn nil, errors.New(\"id_token missing sub claim\")","sourceCodeStart":1940,"sourceCodeEnd":1976,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1940-L1976","documentation":"The keyFunc callback rejects an id_token whose alg header is not an RSA signing method. Only RS256/RS384/RS512 are accepted; anything else (HS256, none, ES256) indicates a misconfigured or malicious issuer and the token is refused.","triggerScenarios":"Thrown at internal/application/service/user.go:1958 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the IdP to sign id_tokens with RS256/RS384/RS512","Confirm the OIDC client config targets the right issuer","Never weaken the algorithm allowlist to accept the offered alg"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}