gofr-dev/gofr · error

require non-empty provider

Error message

require non-empty provider

What it means

errEmptyProvider is a sentinel in GoFr's OAuth middleware returned by NewOAuthProvider (and helpers like ExtractAuthHeader/getPublicKeyFunc paths that validate inputs). It is returned when the OAuth provider name (e.g. the JWKS/issuer identifier used to fetch public keys) is an empty string. Without a provider the middleware cannot discover signing keys or validate JWTs.

Source

Thrown at pkg/gofr/http/middleware/oauth.go:22

	"context"
	"crypto/rsa"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"math/big"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var (
	errEmptyProvider       = errors.New("require non-empty provider")
	errInvalidInterval     = errors.New("invalid interval, require a value greater than 1 second")
	errEmptyModulus        = errors.New("modulus is empty")
	errEmptyPublicExponent = errors.New("public exponent is empty")
	errEmptyResponseBody   = errors.New("response body is empty")
	errInvalidURL          = errors.New("invalid URL")
)

const jwtRegexPattern = "^[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+$"

// PublicKeys stores a map of public keys identified by their key ID (kid).
type PublicKeys struct {
	mu   sync.RWMutex
	keys map[string]*rsa.PublicKey
}

// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).
type JWKNotFound struct {
}

View on GitHub (pinned to 187eb24962)

Solutions

1. Pass a non-empty provider name/URL to NewOAuthProvider
2. Verify the config/env var that supplies the provider value is set at startup
3. Fail fast with a startup check: if provider == "" return a fatal config error
4. Review OAuth middleware setup order so the provider is resolved before the middleware is registered

Example fix

// before
provider := os.Getenv("OAUTH_PROVIDER") // ""
oauth, err := middleware.NewOAuthProvider(provider, interval) // errEmptyProvider
// after
provider := os.Getenv("OAUTH_PROVIDER")
if provider == "" { log.Fatal("OAUTH_PROVIDER is required") }
oauth, err := middleware.NewOAuthProvider(provider, interval)

if provider == "" {
    return errors.New("OAUTH provider must be set before constructing the OAuth middleware")
}

func providerConfigured(p string) bool { return strings.TrimSpace(p) != "" }

oauth, err := middleware.NewOAuthProvider(provider, interval)
if err != nil {
    if errors.Is(err, middleware.ErrEmptyProvider) {
        log.Fatal("oauth provider name missing in configuration")
    }
    return err
}

When it happens

Trigger: Calling NewOAuthProvider("") or otherwise leaving the provider argument unset; the same guard is enforced when extracting auth headers or resolving public keys with no provider configured.

Common situations: OAuth provider name read from an env var or config key that is unset, YAML key renamed during migration, or copy-pasted setup code omitting the provider argument.

Related errors

• invalid interval, require a value greater than 1 second
• modulus is empty
• api keys list is empty
• validate func is empty
• user list is empty

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/bb35c4d890ac5ebe. Report an issue: GitHub.