kataras/iris · error

auth: signout: verify: %w

Error message

auth: signout: verify: %w

What it means

Auth.Signout failed while verifying the token that identifies the session to invalidate. Before revoking tokens via providers, Signout verifies the presented token; a failed verification aborts signout with this wrapper.

Source

Thrown at auth/auth.go:532

	refreshToken := jwt.BytesToString(refreshTokenBytes)

	s.trySetCookie(ctx, accessToken)

	resp := SigninResponse{
		AccessToken:  accessToken,
		RefreshToken: refreshToken,
	}
	ctx.JSON(resp)
}

// Signout accepts the access token and a boolean which reports whether
// the signout should be applied to all tokens generated for a specific user (logout from all devices)
// or just the provided token's one.
// It calls the Provider's InvalidateToken(all=false) or InvalidateTokens (all=true).
func (s *Auth[T]) Signout(ctx stdContext.Context, token []byte, all bool) error {
	t, standardClaims, err := s.verify(ctx, token)
	if err != nil {
		return fmt.Errorf("auth: signout: verify: %w", err)
	}

	for i, n := 0, len(s.providers)-1; i <= n; i++ {
		p := s.providers[i]

		if all {
			err = p.InvalidateTokens(ctx, t)
		} else {
			err = p.InvalidateToken(ctx, standardClaims, t)
		}

		if err != nil {
			if i == n { // last provider errored.
				return err
			}
			// keep trying.
			continue
		}

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Inspect the wrapped verification error (expired vs signature)
2. Allow signout with expired tokens by relaxing verification for signout, or treat this as already-signed-out and return success
3. Ensure clients still hold a valid (unexpired) token when calling signout
4. Check key configuration matches what issued the token

Example fix

// before
if err := auth.Signout(ctx, tok, false); err != nil { http.Error(w, err.Error(), 500) }
// after
if err := auth.Signout(ctx, tok, false); err != nil {
    // expired token = already logged out client-side; do not hard-fail
    http.Error(w, "already signed out", 401); return
}

tok := strings.TrimSpace(strings.TrimPrefix(req.Header.Get("Authorization"), "Bearer "))
if tok == "" { http.Error(w, "missing token", http.StatusUnauthorized); return }

if err := auth.Signout(ctx, token, all); err != nil {
    // an expired token often means the user is already signed out client-side
    log.Printf("signout verify failed: %v", err)
    http.Error(w, "already signed out", http.StatusUnauthorized); return
}

When it happens

Trigger: Auth.Signout(ctx, token, all) is called with token bytes that s.verify rejects: expired access token, wrong signing key, or malformed input — reached via signoutHandler.

Common situations: Client tries to sign out with an already-expired token; the server rotated keys so old tokens no longer verify; a client posts an empty body to the signout endpoint.

Related errors

• auth: verify: %w
• access: %w
• refresh: %w
• auth: refresh: disabled
• auth: refresh: %w

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/da36acfa9c76e23b. Report an issue: GitHub.