kgretzky/evilginx2 · error

auth_tokens: 'header' not found for http auth token

Error message

auth_tokens: 'header' not found for http auth token

What it means

Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'header' field. 'header' specifies which HTTP header carries the token; without it the library cannot inject or extract the token, so the phishlet is rejected.

Source

Thrown at core/phishlet.go:574

				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for http auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for http auth token")
			}
			if at.Header == nil {
				return fmt.Errorf("auth_tokens: 'header' not found for http auth token")
			}

			err := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))
			if err != nil {
				return err
			}
		}
	}
	for _, au := range fp.AuthUrls {
		re, err := regexp.Compile(p.paramVal(au))
		if err != nil {
			return err
		}
		p.authUrls = append(p.authUrls, re)
	}

	if fp.Credentials.Username.Key == nil {
		return fmt.Errorf("credentials: missing username `key` field")

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a 'header:' field with the actual HTTP header name (e.g. Authorization)
2. Verify indentation groups 'header' with the same list item as 'type: http'
3. Test the phishlet load after the fix

Example fix

// before
  - type: http
    domain: '.example.com'
    path: '/'
    name: authz
// after
  - type: http
    domain: '.example.com'
    path: '/'
    name: authz
    header: Authorization

for i, at := range cfg.AuthTokens {
  if at.Type == "http" && (at.Header == nil || *at.Header == "") {
    return fmt.Errorf("auth_tokens[%d]: http token missing 'header'", i)
  }
}

func hasHeader(at AuthToken) bool { return at.Header != nil && *at.Header != "" }

When it happens

Trigger: An http auth_tokens entry sets domain/path/name but omits 'header', or 'header' is misspelled/indented outside the entry.

Common situations: Writing a phishlet for an API target and forgetting the header key; assuming 'name' doubles as the header name (it does not); partial edits removing the header line.

Related errors

• auth_tokens: 'search' not found for body auth token
• auth_tokens: 'domain' not found for http auth token
• auth_tokens: 'path' not found for http auth token
• auth_tokens: 'name' not found for http auth token
• credentials: missing username `key` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/bc49ed03711c30ea. Report an issue: GitHub.