dgraph-io/dgraph · error

invalid jwt auth token

Error message

invalid jwt auth token

What it means

After extracting JWT metadata, `ExtractCustomClaims` expects exactly one token value under the AuthJwtCtxKey metadata key. If the metadata map contains more than one value for that key, the request is considered malformed and rejected with `invalid jwt auth token`.

Source

Thrown at graphql/authorization/auth.go:322

	}
	return nil
}

func (a *AuthMeta) ExtractCustomClaims(ctx context.Context) (*CustomClaims, error) {
	if a == nil {
		return &CustomClaims{}, nil
	}
	// return CustomClaims containing jwt and authvariables.
	md, _ := metadata.FromIncomingContext(ctx)
	jwtToken := md.Get(string(AuthJwtCtxKey))
	if len(jwtToken) == 0 {
		if a.ClosedByDefault {
			return &CustomClaims{}, fmt.Errorf("a valid JWT is required but was not provided")
		}
		return &CustomClaims{}, nil
	}
	if len(jwtToken) > 1 {
		return nil, fmt.Errorf("invalid jwt auth token")
	}
	return a.validateJWTCustomClaims(jwtToken[0])
}

func GetJwtToken(ctx context.Context) string {
	md, ok := metadata.FromIncomingContext(ctx)
	if !ok {
		return ""
	}
	jwtToken := md.Get(string(AuthJwtCtxKey))
	if len(jwtToken) != 1 {
		return ""
	}
	return jwtToken[0]
}

// validateThroughJWKUrl validates the JWT token against the given list of JWKUrls.
// It returns an error only if the token is not validated against even one of the

View on GitHub (pinned to 759e242be6)

Solutions

1. Send the auth header exactly once per request — remove duplicates at the client or proxy
2. Inspect request headers after any middleware/proxy to confirm a single Authorization (or configured) header
3. Deduplicate headers in your ingress (e.g. nginx can merge duplicate headers into one comma-joined value, which avoids this specific multi-value metadata path but breaks JWT parsing — so drop extras instead)

Example fix

// before
headers: { Authorization: 'Bearer tok', authorization: 'Bearer tok' }
// after
headers: { Authorization: 'Bearer tok' }

const authHeaders = rawHeaders.filter(h => h.toLowerCase() === 'authorization');
if (authHeaders.length > 1) throw new Error('Duplicate Authorization header');

When it happens

Trigger: Attaching the same auth-header key more than once in the request metadata (duplicate Authorization/X-Auth-Token headers), so gRPC metadata holds a slice with >1 entry for the JWT context key.

Common situations: A proxy or middleware adding the auth header when the client already supplied it; case-variant duplicates of the same header normalized to the same metadata key; retry logic appending the header again.

Related errors

• expecting either JWKUrl or JWKUrls, both were given
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),
• required field missing in Dgraph.Authorization:%s
• invalid Bearer-formatted header value for JWT (%s)
• audience value was expected but not provided

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/72fe2e675d6107c5. Report an issue: GitHub.