kubernetes/kops · error

incorrect authorization format

Error message

incorrect authorization format

What it means

Verification guard in verifyTokenV1: while parsing the comma-separated Authorization header components, a component had no '=' separator, so the Credential/Signature/SignedHeaders values cannot be extracted.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:181

	decodedHeaders := http.Header(decoded)

	if decodedHeaders.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	authorization := decodedHeaders.Get("Authorization")
	if !strings.HasPrefix(authorization, "AWS4-HMAC-SHA256 ") {
		return nil, fmt.Errorf("incorrect authorization algorithm")
	}

	amzSignature := ""
	amzCredential := ""
	amzSignedHeaders := ""

	for _, token := range strings.Split(strings.TrimPrefix(authorization, "AWS4-HMAC-SHA256 "), ", ") {
		kv := strings.SplitN(token, "=", 2)
		if len(kv) == 1 {
			return nil, fmt.Errorf("incorrect authorization format")
		}
		got := kv[1]
		switch kv[0] {
		case "Signature":
			amzSignature = got
		case "Credential":
			amzCredential = got
		case "SignedHeaders":
			amzSignedHeaders = got
		}
	}
	signedHeaders := sets.New(strings.Split(amzSignedHeaders, ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if amzSignature == "" {
		return nil, fmt.Errorf("unexpected signature value")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the Authorization header uses 'Key=Value' pairs
2. Regenerate the presigned token
3. Avoid proxies that mangle authorization headers

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:181 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aba2031ca2c1bd48. Report an issue: GitHub.