crowdsecurity/crowdsec · error

MachineID not found in claims

Error message

MachineID not found in claims

What it means

After extracting JWT claims, getMachineIDFromContext looks up claims[middlewares.MachineIDKey]; the key is absent when the token was signed without the machine ID claim. The middleware returns "MachineID not found in claims", so callers cannot identify which machine issued the request.

Source

Thrown at pkg/apiserver/controllers/v1/utils.go:46

}

func isUnixSocket(c *gin.Context) bool {
	if localAddr, ok := c.Request.Context().Value(http.LocalAddrContextKey).(net.Addr); ok {
		return strings.HasPrefix(localAddr.Network(), "unix")
	}

	return false
}

func getMachineIDFromContext(ctx *gin.Context) (string, error) {
	claims := jwt.ExtractClaims(ctx)
	if claims == nil {
		return "", errors.New("failed to extract claims")
	}

	rawID, ok := claims[middlewares.MachineIDKey]
	if !ok {
		return "", errors.New("MachineID not found in claims")
	}

	id, ok := rawID.(string)
	if !ok {
		// should never happen
		return "", errors.New("failed to cast machineID to string")
	}

	return id, nil
}

func (*Controller) AbortRemoteIf(option bool) gin.HandlerFunc {
	return func(gctx *gin.Context) {
		if !option {
			return
		}

		if isUnixSocket(gctx) {

View on GitHub (pinned to 909b515798)

Solutions

1. Log the machine in again (cscli machines login / crowdsec LAPI auth) to get a token containing the machine ID claim
2. Upgrade all agents/bouncers to a version that emits the MachineID claim
3. Fix custom token-issuing code to include middlewares.MachineIDKey in the jwt payload (see jwt.IdentityHandler / PayloadFunc)
4. Check that no proxy or shim rewrites or truncates the JWT payload

Example fix

// before: payload without machine id
return jwt.MapClaims{"iss": "crowdsec"}
// after
return jwt.MapClaims{"iss": "crowdsec", middlewares.MachineIDKey: machineID}

claims := jwt.ExtractClaims(c)
if claims == nil {
    return errors.New("no claims")
}
if _, ok := claims[middlewares.MachineIDKey]; !ok {
    return errors.New("token lacks machineID claim; re-login required")
}

rawID, ok := claims[middlewares.MachineIDKey].(string)
if !ok || rawID == "" { /* invalid token, force re-auth */ }

machineID, err := getMachineIDFromContext(c)
if err != nil {
    c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "invalid token: re-login the machine"})
    return
}

When it happens

Trigger: A JWT whose payload lacks the MachineIDKey field: tokens minted by an older crowdsec version, hand-crafted tokens in tests, or a login flow that did not pass the machine ID into the jwt payload when signing.

Common situations: Mixed-version clusters where an old agent token lacks the claim; custom LAPI login tooling; tokens issued before a crowdsec upgrade changed the claim set.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• failed to extract claims
• failed to cast machineID to string
• token missing required claim
• appsec datasource requires a hub. this is a bug, please repo
• appsec datasource requires a lapi client configuration. this

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4bcb5383156de161. Report an issue: GitHub.