kgretzky/evilginx2 · error

auth_tokens: 'domain' not found for http auth token

Error message

auth_tokens: 'domain' not found for http auth token

What it means

Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'domain' field. HTTP header auth tokens need domain, path, name, and header; domain is required to scope which host the token applies to. The phishlet fails to load.

Source

Thrown at core/phishlet.go:565

				return fmt.Errorf("auth_tokens: 'domain' not found for body auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")
			}
			if at.Search == nil {
				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for http auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for http auth token")
			}
			if at.Header == nil {
				return fmt.Errorf("auth_tokens: 'header' not found for http auth token")
			}

			err := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))
			if err != nil {
				return err
			}
		}
	}
	for _, au := range fp.AuthUrls {

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a 'domain:' field (e.g. '.example.com') to the http auth_tokens entry
2. Check indentation so 'domain' belongs to the same list item as 'type: http'
3. Compare against a working example phishlet's http token structure

Example fix

// before
auth_tokens:
  - type: http
    path: '/api'
    name: Authorization
    header: Authorization
// after
auth_tokens:
  - type: http
    domain: '.example.com'
    path: '/api'
    name: Authorization
    header: Authorization

for i, at := range cfg.AuthTokens {
  if at.Type == "http" && (at.Domain == nil || *at.Domain == "") {
    return fmt.Errorf("auth_tokens[%d]: http token missing 'domain'", i)
  }
}

func hasDomain(at AuthToken) bool { return at.Domain != nil && *at.Domain != "" }

When it happens

Trigger: A phishlet YAML defines auth_tokens entry with type: http but omits 'domain', or the key is misspelled/indented outside the entry.

Common situations: Writing a header-token phishlet from scratch and forgetting domain; copying a body-token template (where domain may look optional to the author); YAML tab/space indentation errors detaching the key.

Related errors

• auth_tokens: 'search' not found for body auth token
• auth_tokens: 'path' not found for http auth token
• auth_tokens: 'name' not found for http auth token
• auth_tokens: 'header' not found for http auth token
• credentials: missing username `key` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/0c06f267d040a21c. Report an issue: GitHub.