kataras/iris · error

auth: verify: %w

Error message

auth: verify: %w

What it means

The public Auth.Verify wraps any error from the internal s.verify() call (token parse, signature check, expiry, custom claims) with this prefix. It is the generic 'the token could not be verified' surface for library users.

Source

Thrown at auth/auth.go:362

	}
	accessToken := jwt.BytesToString(accessTokenBytes)
	refreshToken := jwt.BytesToString(refreshTokenBytes)

	s.trySetCookie(ctx, accessToken)

	resp := SigninResponse{
		AccessToken:  accessToken,
		RefreshToken: refreshToken,
	}
	ctx.JSON(resp)
}

// Verify accepts a token and verifies it.
// It returns the token's custom and standard JWT claims.
func (s *Auth[T]) Verify(ctx stdContext.Context, token []byte, verifyFuncs ...VerifyUserFunc[T]) (T, StandardClaims, error) {
	t, claims, err := s.verify(ctx, token)
	if err != nil {
		return t, StandardClaims{}, fmt.Errorf("auth: verify: %w", err)
	}

	for _, verify := range verifyFuncs {
		if verify == nil {
			continue
		}

		if err = verify(t); err != nil {
			return t, StandardClaims{}, fmt.Errorf("auth: verify: %w", err)
		}
	}

	return t, claims, nil
}

func (s *Auth[T]) verify(ctx stdContext.Context, token []byte) (T, StandardClaims, error) {
	var t T

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Read the wrapped error to distinguish expiry vs signature vs malformed token
2. Re-sign the token client-side with the same key/algorithm the server configured
3. Check for clock skew or key-rotation mismatch between services
4. Ensure the full token (not a truncated header value like 'Bearer x') is passed to Verify

Example fix

// before
tok := strings.TrimPrefix(req.Header.Get("Authorization"), "Bearer ")
t, claims, err := auth.Verify(ctx, []byte(tok))
// after
tok := strings.TrimSpace(strings.TrimPrefix(req.Header.Get("Authorization"), "Bearer "))
if tok == "" { http.Error(w, "missing token", 401); return }
t, claims, err := auth.Verify(ctx, []byte(tok))

tok := strings.TrimSpace(strings.TrimPrefix(req.Header.Get("Authorization"), "Bearer "))
if tok == "" { return errors.New("missing bearer token") }

func hasToken(h http.Header) ([]byte, bool) {
    raw := strings.TrimPrefix(h.Get("Authorization"), "Bearer ")
    return []byte(raw), len(raw) > 0 && strings.Count(raw, ".") == 2
}

t, claims, err := auth.Verify(ctx, token)
if err != nil {
    if errors.Is(err, jwt.ErrExpired) { http.Error(w, "token expired", http.StatusUnauthorized); return }
    http.Error(w, "invalid token", http.StatusUnauthorized); return
}

When it happens

Trigger: Calling Auth.Verify(ctx, token, verifyFuncs...) with a token that s.verify rejects: malformed token bytes, bad signature, expired token, wrong issuer/audience, or an internal claim extraction failure.

Common situations: Client sends an expired or tampered JWT, tokens signed with a different key than the server configured (e.g. after key rotation), or an empty/missing Authorization header value passed straight to Verify.

Related errors

• auth: refresh: %w
• auth: signout: verify: %w
• access: %w
• refresh: %w
• auth: refresh: disabled

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/8093f58b06fcc426. Report an issue: GitHub.