kubernetes/kops · error

incorrect authorization algorithm

Error message

incorrect authorization algorithm

What it means

verifyTokenV1 checks that the Authorization header inside the signed token starts with the expected AWS SigV4 algorithm prefix (AWS4-HMAC-SHA256). This guard fires when the header is present but uses a different/unknown signing algorithm — a malformed or malicious token that should not proceed to STS validation.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:171

	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %w", err)
	}
	var decoded awsV1Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %w", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	decodedHeaders := http.Header(decoded)

	if decodedHeaders.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	authorization := decodedHeaders.Get("Authorization")
	if !strings.HasPrefix(authorization, "AWS4-HMAC-SHA256 ") {
		return nil, fmt.Errorf("incorrect authorization algorithm")
	}

	amzSignature := ""
	amzCredential := ""
	amzSignedHeaders := ""

	for _, token := range strings.Split(strings.TrimPrefix(authorization, "AWS4-HMAC-SHA256 "), ", ") {
		kv := strings.SplitN(token, "=", 2)
		if len(kv) == 1 {
			return nil, fmt.Errorf("incorrect authorization format")
		}
		got := kv[1]
		switch kv[0] {
		case "Signature":
			amzSignature = got
		case "Credential":
			amzCredential = got
		case "SignedHeaders":

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the token contains an AWS4-HMAC-SHA256 authorization
2. Generate tokens with the kOps-provided helper
3. Match the expected SigV4 format exactly

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:171 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/68ebd6298f999817. Report an issue: GitHub.