gofr-dev/gofr · error

public exponent is empty

Error message

public exponent is empty

What it means

errEmptyPublicExponent is returned by rsaPublicKey in the OAuth2/JWT middleware when a JWKS entry lacks a public exponent (the 'e' field of the RSA JWK). The middleware needs modulus and exponent to reconstruct the RSA public key used to verify JWT signatures. An empty exponent means the identity provider's key set entry is malformed or was parsed incorrectly.

Source

Thrown at pkg/gofr/http/middleware/oauth.go:25

	"encoding/json"
	"errors"
	"fmt"
	"io"
	"math/big"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var (
	errEmptyProvider       = errors.New("require non-empty provider")
	errInvalidInterval     = errors.New("invalid interval, require a value greater than 1 second")
	errEmptyModulus        = errors.New("modulus is empty")
	errEmptyPublicExponent = errors.New("public exponent is empty")
	errEmptyResponseBody   = errors.New("response body is empty")
	errInvalidURL          = errors.New("invalid URL")
)

const jwtRegexPattern = "^[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+$"

// PublicKeys stores a map of public keys identified by their key ID (kid).
type PublicKeys struct {
	mu   sync.RWMutex
	keys map[string]*rsa.PublicKey
}

// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).
type JWKNotFound struct {
}

func (JWKNotFound) Error() string {
	return "JWKS Not Found"

View on GitHub (pinned to 187eb24962)

Solutions

1. Verify the identity provider publishes RSA keys (kty=rsa) with both 'n' (modulus) and 'e' (exponent) in its JWKS
2. Check that the correct JWKS URL is configured for the provider (wrong provider can yield keys without 'e')
3. Fix the JWKS fixture/test data to include the 'e' field (typically 'AQAB')

Example fix

// before
{"kty":"RSA","n":"x base64url modulus"}
// after
{"kty":"RSA","n":"x base64url modulus","e":"AQAB"}

for _, k := range jwks.Keys { if k.Kty == "RSA" && (k.E == "" || k.N == "") { return fmt.Errorf("JWKS key %s missing n/e", k.Kid) } }

func hasRSAExponent(k JWK) bool { return k.Kty == "RSA" && k.E != "" && k.N != "" }

When it happens

Trigger: Calling getPublicKeys/rsaPublicKey against a JWKS endpoint whose keys omit the 'e' field; the identity provider returns a non-RSA key type (e.g. EC) where 'e' is absent; a truncated or hand-crafted JWKS JSON response in tests.

Common situations: Misconfigured OIDC provider exposing non-RSA signing keys; a proxy returning cached/partial JWKS; tests feeding fake JWKS bodies without the exponent field.

Related errors

• modulus is empty
• require non-empty provider
• invalid interval, require a value greater than 1 second
• response body is empty
• %w: deleting document: %w

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/d7df1110c9ade40e. Report an issue: GitHub.