{"record":{"id":"f6eab48afbe69865","repo":"gohugoio/hugo","slug":"hmac-s-is-not-a-supported-hash-function","errorCode":null,"errorMessage":"hmac: %s is not a supported hash function","messagePattern":"hmac: (.+?) is not a supported hash function","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tpl/crypto/crypto.go","lineNumber":145,"sourceCode":"// HMAC returns a cryptographic hash that uses a key to sign a message.\nfunc (ns *Namespace) HMAC(h any, k any, m any, e ...any) (string, error) {\n\tha, err := cast.ToStringE(h)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tvar hash func() hash.Hash\n\tswitch ha {\n\tcase \"md5\":\n\t\thash = md5.New\n\tcase \"sha1\":\n\t\thash = sha1.New\n\tcase \"sha256\":\n\t\thash = sha256.New\n\tcase \"sha512\":\n\t\thash = sha512.New\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"hmac: %s is not a supported hash function\", ha)\n\t}\n\n\tmsg, err := cast.ToStringE(m)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tkey, err := cast.ToStringE(k)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tmac := hmac.New(hash, []byte(key))\n\t_, err = mac.Write([]byte(msg))\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/gohugoio/hugo/blob/52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2/tpl/crypto/crypto.go#L127-L163","documentation":"`crypto.HMAC` (crypto.go:128-146) supports a smaller algorithm set than `crypto.Hash`: only `md5`, `sha1`, `sha256`, `sha512`. There is no `sha384` case, so requesting it (or any other string) hits the `default` arm and returns this error.","triggerScenarios":"`{{ crypto.HMAC \"sha384\" $key $msg }}` (sha384 unsupported for HMAC), `{{ crypto.HMAC \"SHA256\" ... }}` (uppercase), or a typo.","commonSituations":"Assuming HMAC and Hash share the same algorithm list; using uppercase; requesting sha384 because `crypto.Hash` accepts it.","solutions":["Use one of: md5, sha1, sha256, sha512 (lowercase) for HMAC.","If you need sha384 HMAC, compute it in Go and expose the result.","Double-check the algorithm string against the documented HMAC set."],"exampleFix":"// before\n{{ crypto.HMAC \"sha384\" $key $msg }}\n// after\n{{ crypto.HMAC \"sha256\" $key $msg }}","handlingStrategy":"validation","validationCode":"{{/* Valid HMAC algos: md5, sha1, sha256, sha512 (lowercase, no sha384) */}}\n{{ crypto.HMAC \"sha256\" $key $msg }}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["HMAC supports fewer algos than Hash — no sha384.","Use lowercase algorithm names.","Document the HMAC-specific algorithm set in your project."],"tags":["hugo","go-templates","crypto","hmac","invalid-argument"],"backgroundTag":null,"analyzedSha":"52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2","analyzedAt":"2026-08-09T21:49:36.660Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}