nats-io/nats-server · error

invalid JWT

Error message

invalid JWT

What it means

DirJWTStore.write guard: theJWT is empty (zero length), so there is nothing to persist and the write is rejected as an invalid JWT before touching disk or the expiration tracker.

Source

Thrown at server/dirstore.go:417

	store.Lock()
	defer store.Unlock()
	if path := store.pathForKey(publicKey); path == _EMPTY_ {
		return _EMPTY_, fmt.Errorf("invalid public key")
	} else if data, err := os.ReadFile(path); err != nil {
		return _EMPTY_, err
	} else {
		if store.expiration != nil {
			store.expiration.updateTrack(publicKey)
		}
		return string(data), nil
	}
}

// write that keeps hash of all jwt in sync
// Assumes the lock is held. Does return true or an error never both.
func (store *DirJWTStore) write(path string, publicKey string, theJWT string) (bool, error) {
	if len(theJWT) == 0 {
		return false, fmt.Errorf("invalid JWT")
	}
	var newHash *[sha256.Size]byte
	if store.expiration != nil {
		h := sha256.Sum256([]byte(theJWT))
		newHash = &h
		if v, ok := store.expiration.idx[publicKey]; ok {
			store.expiration.updateTrack(publicKey)
			// this write is an update, move to back
			it := v.Value.(*jwtItem)
			oldHash := it.hash[:]
			if bytes.Equal(oldHash, newHash[:]) {
				return false, nil
			}
		} else if int64(store.expiration.Len()) >= store.expiration.limit {
			if !store.expiration.evictOnLimit {
				return false, errors.New("jwt store is full")
			}
			// this write is an add, pick the least recently used value for removal

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Pass a non-empty serialized JWT to save
2. Check upstream claim serialization before saving
3. Skip writes when the JWT is empty rather than erroring, if the caller treats it as optional

When it happens

Trigger: Thrown at server/dirstore.go:417 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/9d8e89006dbd11eb. Report an issue: GitHub.