gofiber/fiber · error

fiber: keyauth scope contains invalid token

Error message

fiber: keyauth scope contains invalid token

What it means

When Error is insufficient_scope, keyauth splits Config.Scope on spaces and validates each token with isScopeToken, which rejects empty strings and any character outside the printable ASCII range 0x21-0x7e or containing double-quote/backslash. A token failing that check panics in configDefault().

Source

Thrown at middleware/keyauth/config.go:156

	}
	if cfg.ErrorDescription != "" && cfg.Error == "" {
		panic("fiber: keyauth error_description requires error")
	}
	if cfg.ErrorURI != "" {
		if cfg.Error == "" {
			panic("fiber: keyauth error_uri requires error")
		}
		if u, err := url.Parse(cfg.ErrorURI); err != nil || !u.IsAbs() {
			panic("fiber: keyauth error_uri must be absolute")
		}
	}
	if cfg.Error == ErrorInsufficientScope {
		if cfg.Scope == "" {
			panic("fiber: keyauth insufficient_scope requires scope")
		}
		for scope := range strings.SplitSeq(cfg.Scope, " ") {
			if scope == "" || !isScopeToken(scope) {
				panic("fiber: keyauth scope contains invalid token")
			}
		}
	} else if cfg.Scope != "" {
		panic("fiber: keyauth scope requires insufficient_scope error")
	}

	return cfg
}

func isScopeToken(s string) bool {
	for i := 0; i < len(s); i++ {
		c := s[i]
		if c < 0x21 || c > 0x7e || c == '"' || c == '\\' {
			return false
		}
	}
	return s != ""
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Use single spaces as the only delimiter and ensure no leading/trailing/duplicate spaces.
2. Strip any comma separators or quotes before assigning to Scope.
3. Validate each token against the isScopeToken rule (printable ASCII 0x21-0x7e, no quotes/backslashes) before constructing the middleware.

Example fix

// before
app.Use(keyauth.New(keyauth.Config{
    Validator: validateKey,
    Error:     keyauth.ErrorInsufficientScope,
    Scope:     "read, write",
}))
// after
app.Use(keyauth.New(keyauth.Config{
    Validator: validateKey,
    Error:     keyauth.ErrorInsufficientScope,
    Scope:     "read write",
}))

for _, tok := range strings.Split(cfg.Scope, " ") {
    if tok == "" {
        log.Fatalf("keyauth: empty scope token in %q (check double/trailing spaces)", cfg.Scope)
    }
    for i := 0; i < len(tok); i++ {
        c := tok[i]
        if c < 0x21 || c > 0x7e || c == '"' || c == '\\' {
            log.Fatalf("keyauth: invalid char in scope token %q", tok)
        }
    }
}

When it happens

Trigger: Setting Config.Scope to a value with a double space (producing an empty token), a trailing space, a tab/newline separator, or characters like \\" or \\. Any of these produce at least one invalid scope token that triggers the panic.

Common situations: Building scope from a comma-separated list instead of space-separated (e.g. "read,write"). Accidental trailing whitespace from trimming failures. Including quotes or backslashes from JSON-unescaped values. Copying scopes that contain Unicode characters.

Related errors

• fiber: keyauth insufficient_scope requires scope
• fiber: keyauth scope requires insufficient_scope error
• fiber: keyauth unsupported error token
• fiber: keyauth error_description requires error
• fiber: keyauth error_uri requires error

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/5683829ed6a994d3.json. Report an issue: GitHub.