{"record":{"id":"ffd3ba6603c5d8b5","repo":"Pumpkin-MC/Pumpkin","slug":"invalid-signature","errorCode":null,"errorMessage":"Invalid signature","messagePattern":"Invalid signature","errorType":"error_code","errorClass":"AuthError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin-auth/src/jwt/mod.rs","lineNumber":51,"sourceCode":"    #[error(\"Invalid token format\")]\n    InvalidTokenFormat,\n    /// Indicates that the 'x5u' (X.509 URL) header parameter is missing from a token.\n    #[error(\"x5u not found in header\")]\n    MissingX5U,\n    /// Indicates a failure in Base64 decoding.\n    #[error(\"Base64 decoding failed: {0}\")]\n    Base64Decode(#[from] base64::DecodeError),\n    /// Indicates a failure in parsing JSON data.\n    #[error(\"JSON parse error: {0}\")]\n    JsonParse(#[from] serde_json::Error),\n    /// Indicates a failure in building a public key from its representation.\n    #[error(\"Public key build failed: {0}\")]\n    PublicKeyBuild(String),\n    /// Indicates that the token was not signed by the trusted Mojang public key.\n    #[error(\"Token not signed by trusted Mojang key\")]\n    MojangKeyMismatch,\n    /// Indicates that the token's signature is invalid.\n    #[error(\"Invalid signature\")]\n    InvalidSignature,\n    /// Indicates an error related to ECDSA signature operations.\n    #[error(\"ECDSA signature error: {0}\")]\n    Ecdsa(#[from] ecdsa::Error),\n}\n\n/// Decodes a Base64 URL-safe encoded string with no padding.\n///\n/// # Arguments\n///\n/// * `s` - The Base64 URL-safe encoded string to decode.\n///\n/// # Returns\n///\n/// A `Result` containing the decoded bytes or a `base64::DecodeError`.\npub fn decode_b64_url_nopad(s: &str) -> Result<Vec<u8>, base64::DecodeError> {\n    general_purpose::URL_SAFE_NO_PAD.decode(s)\n}","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-auth/src/jwt/mod.rs#L33-L69","documentation":"This variant indicates the ECDSA signature on a JWT is invalid — the signed data does not match the signature when verified with the token's key. It is raised during Mojang token verification when the cryptographic signature check fails, distinguishing signature corruption/forgery from key-trust failures (MojangKeyMismatch).","triggerScenarios":"Verifying a JWT whose signature bytes were decoded successfully but fail ecdsa::verify; tokens truncated mid-signature, tampered payloads, or signatures produced with a different key.","commonSituations":"Tampered tokens from modified clients; base64 padding/URL-safe alphabet mistakes that corrupt the signature bytes; proxies rewriting token bodies.","solutions":["Reject the token and disconnect the client; an invalid signature cannot be retried or repaired","Verify the signature bytes are decoded with URL-safe Base64 without padding before verification","Confirm the exact signed message (header.payload concatenation) is passed to verification, not a re-serialized version","Compare header/payload bytes received on the wire against what the client claims to send to rule out proxy modification"],"exampleFix":"// before\nlet sig = Signature::from_slice(&raw_sig).map_err(AuthError::from)?;\nverify(msg, &sig)?;\n// after\nif let Err(e) = verifying_key.verify(msg, &sig) {\n    log::warn!(\"invalid token signature: {e}; disconnecting client\");\n    return Err(AuthError::InvalidSignature);\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match jwt::verify(&token) {\n    Err(jwt::Error::InvalidSignature) => {\n        log::warn!(\"token signature check failed; disconnecting client\");\n    }\n    r => r?,\n}","preventionTips":["Verify over the exact header.payload byte string, never a re-serialized copy","Decode signature bytes with URL-safe Base64 without padding","Disconnect on invalid signatures; they cannot be repaired by retrying","Watch for proxies that rewrite token payloads"],"tags":["jwt","ecdsa","signature","authentication","rust"],"backgroundTag":"jwt-signature-verification-failed","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}