kgretzky/evilginx2 · error

auth_tokens: invalid token type: %s

Error message

auth_tokens: invalid token type: %s

What it means

This error is thrown while validating a phishlet's `auth_tokens` section when an entry's `type` field contains a value not present in AUTH_TOKEN_TYPES (only "cookie" and "body" are supported). The default type is "cookie" when omitted; an explicit but unknown type is rejected at load time.

Source

Thrown at core/phishlet.go:527

			if ic.Body != nil {
				body = *ic.Body
			}
			if ic.Mime != nil {
				mime = *ic.Mime
			}
			err = p.addIntercept(*ic.Domain, path_re, *ic.HttpStatus, body, mime)
			if err != nil {
				return err
			}
		}
	}
	for _, at := range *fp.AuthTokens {
		ttype := "cookie"
		if at.Type != nil {
			ttype = *at.Type
		}
		if !stringExists(ttype, AUTH_TOKEN_TYPES) {
			return fmt.Errorf("auth_tokens: invalid token type: %s", ttype)
		}
		switch ttype {
		case "cookie":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for cookie auth token")
			}
			if at.Keys == nil {
				return fmt.Errorf("auth_tokens: 'keys' not found for cookie auth token")
			}

			for n := range *at.Keys {
				(*at.Keys)[n] = p.paramVal((*at.Keys)[n])
			}
			err := p.addCookieAuthTokens(p.paramVal(*at.Domain), *at.Keys)
			if err != nil {
				return err
			}
		case "body":

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Change the `type` value to either `cookie` or `body`, the only supported token types.
2. Remove the `type` field entirely if the token is a cookie, since cookie is the default.
3. Check spelling and singular form (`cookie`, not `cookies`).

Example fix

// before (phishlet.yml)
auth_tokens:
  - type: header
    domain: accounts
// after
auth_tokens:
  - type: body
    domain: accounts
    path: ^/api/login$
    name: session
    search: ([A-Za-z0-9]+)

var AUTH_TOKEN_TYPES = []string{"cookie", "body"}

for i, at := range cfg.AuthTokens {
    t := "cookie"
    if at.Type != nil {
        t = *at.Type
    }
    if !contains(AUTH_TOKEN_TYPES, t) {
        return fmt.Errorf("auth_tokens[%d]: invalid token type: %s", i, t)
    }
}

func isKnownTokenType(t string) bool {
    return t == "cookie" || t == "body"
}

When it happens

Trigger: An auth_tokens entry specifies `type: header`, `type: bearer`, `type: session`, or any misspelled value other than `cookie` or `body`.

Common situations: Guessing at token type names; copying auth token config from another tool with a different type vocabulary; typo like `type: cookies` (plural).

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• auth_tokens: 'domain' not found for cookie auth token
• auth_tokens: 'keys' not found for cookie auth token
• auth_tokens: 'domain' not found for body auth token
• auth_tokens: 'path' not found for body auth token
• auth_tokens: 'name' not found for body auth token

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/9004b88860fac9e5. Report an issue: GitHub.