{"id":"79d1a5bc49d76da9","repo":"gofiber/fiber","slug":"fiber-keyauth-insufficient-scope-requires-scope","errorCode":null,"errorMessage":"fiber: keyauth insufficient_scope requires scope","messagePattern":"fiber: keyauth insufficient_scope requires scope","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/keyauth/config.go","lineNumber":152,"sourceCode":"\t\tcase ErrorInvalidRequest, ErrorInvalidToken, ErrorInsufficientScope:\n\t\tdefault:\n\t\t\tpanic(\"fiber: keyauth unsupported error token\")\n\t\t}\n\t}\n\tif cfg.ErrorDescription != \"\" && cfg.Error == \"\" {\n\t\tpanic(\"fiber: keyauth error_description requires error\")\n\t}\n\tif cfg.ErrorURI != \"\" {\n\t\tif cfg.Error == \"\" {\n\t\t\tpanic(\"fiber: keyauth error_uri requires error\")\n\t\t}\n\t\tif u, err := url.Parse(cfg.ErrorURI); err != nil || !u.IsAbs() {\n\t\t\tpanic(\"fiber: keyauth error_uri must be absolute\")\n\t\t}\n\t}\n\tif cfg.Error == ErrorInsufficientScope {\n\t\tif cfg.Scope == \"\" {\n\t\t\tpanic(\"fiber: keyauth insufficient_scope requires scope\")\n\t\t}\n\t\tfor scope := range strings.SplitSeq(cfg.Scope, \" \") {\n\t\t\tif scope == \"\" || !isScopeToken(scope) {\n\t\t\t\tpanic(\"fiber: keyauth scope contains invalid token\")\n\t\t\t}\n\t\t}\n\t} else if cfg.Scope != \"\" {\n\t\tpanic(\"fiber: keyauth scope requires insufficient_scope error\")\n\t}\n\n\treturn cfg\n}\n\nfunc isScopeToken(s string) bool {\n\tfor i := 0; i < len(s); i++ {\n\t\tc := s[i]\n\t\tif c < 0x21 || c > 0x7e || c == '\"' || c == '\\\\' {\n\t\t\treturn false","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/keyauth/config.go#L134-L170","documentation":"When keyauth Config.Error is set to ErrorInsufficientScope, RFC 6750 requires a scope parameter telling the client which scopes are needed. Leaving Config.Scope empty in that case panics in configDefault(), because the challenge would not tell the client what scopes to request.","triggerScenarios":"Calling keyauth.New() with Config.Error set to keyauth.ErrorInsufficientScope but Config.Scope left empty. The check at config.go:150-153 fires immediately after the error token validation passes.","commonSituations":"Enabling scope-based authorization for the first time and forgetting the scope list. Copying a config template that set Error but commented out Scope. Refactoring auth and dropping the scope string.","solutions":["Set Config.Scope to a space-delimited list of required scopes, e.g. \"read write\".","If you do not actually do scope checks, use a different Error code (invalid_token) instead of insufficient_scope.","Centralize scope strings in constants to avoid leaving the field empty by accident."],"exampleFix":"// before\napp.Use(keyauth.New(keyauth.Config{\n    Validator: validateKey,\n    Error:     keyauth.ErrorInsufficientScope,\n}))\n// after\napp.Use(keyauth.New(keyauth.Config{\n    Validator: validateKey,\n    Error:     keyauth.ErrorInsufficientScope,\n    Scope:     \"read write\",\n}))","handlingStrategy":"validation","validationCode":"if cfg.Error == keyauth.ErrorInsufficientScope && cfg.Scope == \"\" {\n    log.Fatal(\"keyauth: insufficient_scope requires a non-empty Scope\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Define required scopes as a constant and reference it in both validation logic and config.","Treat Error=insufficient_scope and Scope as a single coupled setting."],"tags":["keyauth","config","auth","rfc6750","scope","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}