What causes "auth_tokens: 'name' not found for http auth token" in kgretzky/evilginx2?

Add a 'name:' field (arbitrary unique token identifier) to the http auth_tokens entry

auth_tokens: 'name' not found for http auth token

Error message

auth_tokens: 'name' not found for http auth token

What it means

Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'name' field. 'name' identifies the token so it can be tracked and re-injected; without it the phishlet cannot load.

Source

Thrown at core/phishlet.go:571

				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")
			}
			if at.Search == nil {
				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for http auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for http auth token")
			}
			if at.Header == nil {
				return fmt.Errorf("auth_tokens: 'header' not found for http auth token")
			}

			err := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))
			if err != nil {
				return err
			}
		}
	}
	for _, au := range fp.AuthUrls {
		re, err := regexp.Compile(p.paramVal(au))
		if err != nil {
			return err
		}
		p.authUrls = append(p.authUrls, re)
	}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add a 'name:' field (arbitrary unique token identifier) to the http auth_tokens entry
Ensure 'name' and 'header' are both present and correctly indented
Validate the phishlet with the CLI before deploying

Example fix

// before
  - type: http
    domain: '.example.com'
    path: '/'
    header: X-Session
// after
  - type: http
    domain: '.example.com'
    path: '/'
    name: session_token
    header: X-Session

Defensive patterns

Strategy: validation

Validate before calling

for i, at := range cfg.AuthTokens {
  if at.Type == "http" && (at.Name == nil || *at.Name == "") {
    return fmt.Errorf("auth_tokens[%d]: http token missing 'name'", i)
  }
}

Type guard

func hasName(at AuthToken) bool { return at.Name != nil && *at.Name != "" }

Prevention

Give each token a unique, descriptive name distinct from the header field
Keep name and header adjacent in the YAML to avoid dropping one
Run phishlet validation after every edit

When it happens

Trigger: An http auth_tokens entry in the phishlet YAML sets domain/path/header but omits 'name', or 'name' is misspelled or attached to the wrong list item due to indentation.

Common situations: Forgetting the identifier when writing header-token configs; confusing 'name' (internal token id) with 'header' (actual HTTP header); YAML copy-paste dropping a line.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c7cb0fa601a885d5. Report an issue: GitHub.