{"record":{"id":"ef57eae98ca56250","repo":"t8y2/dbx","slug":"hive-jwt-authentication-requires-jwt-or-the-jwt-en-ef57ea","errorCode":null,"errorMessage":"Hive JWT authentication requires jwt or the JWT environment variable","messagePattern":"Hive JWT authentication requires jwt or the JWT environment variable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":583,"sourceCode":"\tconfig.BrowserToken = firstNonEmpty(parameter(values, \"browsertoken\"), parameter(values, \"token\"))\n\tconfig.BrowserClientID = parameter(values, \"browserclientidentifier\")\n\tif value := parameter(values, \"browserresponseport\"); value != \"\" {\n\t\tparsed, err := strconv.Atoi(value)\n\t\tif err != nil || parsed < 0 || parsed > 65535 {\n\t\t\treturn fmt.Errorf(\"invalid Hive browserResponsePort %q: expected 0-65535\", value)\n\t\t}\n\t\tconfig.BrowserResponsePort = parsed\n\t}\n\tif value := parameter(values, \"browserresponsetimeout\"); value != \"\" {\n\t\tparsed, err := strconv.ParseInt(value, 10, 64)\n\t\tif err != nil || parsed <= 0 {\n\t\t\treturn fmt.Errorf(\"invalid Hive browserResponseTimeout %q: expected positive seconds\", value)\n\t\t}\n\t\tconfig.BrowserResponseTimeout = time.Duration(parsed) * time.Second\n\t}\n\tconfig.BrowserDisableSSLCheck = parameterBool(values, \"browserdisablesslcheck\")\n\tif strings.EqualFold(config.Auth, \"JWT\") && config.JWT == \"\" {\n\t\treturn errors.New(\"Hive JWT authentication requires jwt or the JWT environment variable\")\n\t}\n\tif value := parameter(values, \"fetchsize\"); value != \"\" {\n\t\tparsed, err := strconv.Atoi(value)\n\t\tif err != nil || parsed <= 0 {\n\t\t\treturn fmt.Errorf(\"invalid Hive fetchSize %q: expected a positive integer\", value)\n\t\t}\n\t\tconfig.FetchSize = parsed\n\t}\n\tif value := parameter(values, \"sockettimeout\"); value != \"\" {\n\t\tparsed, err := strconv.ParseInt(value, 10, 64)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid Hive socketTimeout %q: expected seconds\", value)\n\t\t}\n\t\tif parsed > 0 {\n\t\t\tconfig.SocketTimeout = time.Duration(parsed) * time.Second\n\t\t}\n\t}\n\tif value := parameter(values, \"thrift.client.max.message.size\"); value != \"\" {","sourceCodeStart":565,"sourceCodeEnd":601,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L565-L601","documentation":"When Auth is set to JWT, the driver requires the token in the 'jwt' parameter (or the JWT environment variable), because JWT auth has no other credential source. If config.JWT remains empty after parameter and environment resolution, the config is rejected.","triggerScenarios":"Setting auth=JWT but forgetting the jwt parameter; the JWT env var unset in the runtime environment; passing the token under a wrong key like 'token' or 'password' instead of 'jwt'.","commonSituations":"Switching a deployment from NONE/LDAP to JWT auth without updating the secret injection, Kubernetes/Docker env where the JWT secret wasn't mounted, DSN strings that include auth=JWT but the token is sent via headers instead.","solutions":["Add the jwt parameter with the bearer token to the connection parameters, or set the JWT environment variable the driver reads.","If using a DSN, URL-encode the token into the connection string's jwt property.","Verify the auth value is intentionally JWT; if you meant another mechanism (e.g. LDAP, NONE), change auth accordingly.","Check secret injection (env vars, mounted files) so the token reaches the process at connect time."],"exampleFix":"// before\nparams := map[string]string{\"auth\": \"JWT\"}\n// after\nparams := map[string]string{\"auth\": \"JWT\", \"jwt\": \"eyJhbGciOi...\"}","handlingStrategy":"validation","validationCode":"func requireJWT(params map[string]string) error {\n    if strings.EqualFold(params[\"auth\"], \"JWT\") &&\n        params[\"jwt\"] == \"\" && os.Getenv(\"JWT\") == \"\" {\n        return errors.New(\"JWT auth requires jwt param or JWT env var\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inject the token under the exact key 'jwt'","Verify secret presence in deployment readiness checks","When changing auth mode, update the corresponding credential source at the same time"],"tags":["hive","authentication","jwt","missing-credential"],"backgroundTag":"missing-credential","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}