{"record":{"id":"fb258caa15ada1f2","repo":"cloudflare/cloudflared","slug":"jwks-response-body-exceeds-d-bytes","errorCode":null,"errorMessage":"JWKS response body exceeds %d bytes","messagePattern":"JWKS response body exceeds (.+?) bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/jwks.go","lineNumber":119,"sourceCode":"\t\t},\n\t\tTimeout: time.Second * 10,\n\t}\n\tresp, err := client.Get(jwksURL.String()) // nolint: gosec\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"failed to fetch JWKS from %s\", jwksURL.String())\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"JWKS endpoint %s returned status %d\", jwksURL.String(), resp.StatusCode)\n\t}\n\n\tbody, err := io.ReadAll(io.LimitReader(resp.Body, maxJWKSResponseSize+1))\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to read JWKS response body\")\n\t}\n\tif len(body) > maxJWKSResponseSize {\n\t\treturn nil, fmt.Errorf(\"JWKS response body exceeds %d bytes\", maxJWKSResponseSize)\n\t}\n\n\tvar keySet jose.JSONWebKeySet\n\tif err := json.Unmarshal(body, &keySet); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to parse JWKS\")\n\t}\n\treturn &keySet, nil\n}\n\n// jwksCachePath returns the on-disk path for cached JWKS for the given auth domain.\nfunc jwksCachePath(authDomain url.URL) (string, error) {\n\tconfigPath, err := getConfigPath()\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tname := authDomain.Hostname() + jwksCacheSuffix\n\treturn filepath.Join(configPath, name), nil\n}","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/jwks.go#L101-L137","documentation":"Size-limit guard in fetchJWKS: the JWKS response body read via LimitReader exceeds maxJWKSResponseSize. This protects against a misbehaving or hostile endpoint returning an unbounded payload; the response is discarded rather than parsed.","triggerScenarios":"Thrown at token/jwks.go:119 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect what the endpoint actually returned — an oversized body indicates the wrong server or a compromised endpoint.","Verify the auth domain resolves to Cloudflare's certs endpoint.","No client-side fix; the limit is a deliberate safety bound."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}