kgretzky/evilginx2 · error

auth_tokens: 'path' not found for http auth token

Error message

auth_tokens: 'path' not found for http auth token

What it means

Thrown during phishlet validation when an auth_tokens entry with type 'http' has no 'path' field. The path scopes the request URL for the header token; without it the library cannot match requests, so the phishlet is rejected.

Source

Thrown at core/phishlet.go:568

				return fmt.Errorf("auth_tokens: 'path' not found for body auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for body auth token")
			}
			if at.Search == nil {
				return fmt.Errorf("auth_tokens: 'search' not found for body auth token")
			}

			err := p.addBodyAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Search))
			if err != nil {
				return err
			}
		case "http":
			if at.Domain == nil {
				return fmt.Errorf("auth_tokens: 'domain' not found for http auth token")
			}
			if at.Path == nil {
				return fmt.Errorf("auth_tokens: 'path' not found for http auth token")
			}
			if at.Name == nil {
				return fmt.Errorf("auth_tokens: 'name' not found for http auth token")
			}
			if at.Header == nil {
				return fmt.Errorf("auth_tokens: 'header' not found for http auth token")
			}

			err := p.addHttpAuthToken(p.paramVal(*at.Domain), p.paramVal(*at.Path), p.paramVal(*at.Name), p.paramVal(*at.Header))
			if err != nil {
				return err
			}
		}
	}
	for _, au := range fp.AuthUrls {
		re, err := regexp.Compile(p.paramVal(au))
		if err != nil {
			return err

View on GitHub (pinned to 4c0988a1d9)

Solutions

1. Add a 'path:' field (usually '/') to the http auth_tokens entry
2. Confirm the path regex matches the target URL path where the token is sent
3. Re-validate the phishlet after editing

Example fix

// before
  - type: http
    domain: '.example.com'
    name: Authorization
    header: Authorization
// after
  - type: http
    domain: '.example.com'
    path: '/'
    name: Authorization
    header: Authorization

for i, at := range cfg.AuthTokens {
  if at.Type == "http" && (at.Path == nil || *at.Path == "") {
    return fmt.Errorf("auth_tokens[%d]: http token missing 'path'", i)
  }
}

func hasPath(at AuthToken) bool { return at.Path != nil && *at.Path != "" }

When it happens

Trigger: A phishlet YAML defines an http auth_tokens entry with domain/name/header but omits 'path', or 'path' is misplaced by indentation.

Common situations: Hand-written phishlet missing path; assuming path defaults to '/' (it does not); copied config where path was deleted during editing.

Related errors

• auth_tokens: 'search' not found for body auth token
• auth_tokens: 'domain' not found for http auth token
• auth_tokens: 'name' not found for http auth token
• auth_tokens: 'header' not found for http auth token
• credentials: missing username `key` field

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/b727a9b8a64e02ce. Report an issue: GitHub.