oauth2-proxy/oauth2-proxy · error

hmacauth: hash algorithm not supported: name

Error message

hmacauth: hash algorithm not supported: name

What it means

DigestNameToCryptoHash in pkg/authentication/hmacauth/hmacauth.go maps a digest algorithm name (e.g. "sha1", "sha256") to a crypto.Hash via the supportedAlgorithms map. If the name is not in the map it returns this error. It is used when parsing signature keys for HMAC request authentication.

Source

Thrown at pkg/authentication/hmacauth/hmacauth.go:71

		algorithmName[algorithm] = name
		// Make sure the algorithm is linked into the binary, per
		// https://golang.org/pkg/crypto/#Hash.Available
		//
		// Note that both sides of the client/server connection must
		// have an algorithm available in order to successfully
		// authenticate using that algorithm
		if !algorithm.Available() {
			delete(supportedAlgorithms, name)
		}
	}
}

// DigestNameToCryptoHash returns the crypto.Hash value corresponding to the
// algorithm name, or an error if the algorithm is not supported.
func DigestNameToCryptoHash(name string) (result crypto.Hash, err error) {
	var supported bool
	if result, supported = supportedAlgorithms[name]; !supported {
		err = errors.New("hmacauth: hash algorithm not supported: " +
			name)
	}
	return
}

// CryptoHashToDigestName returns the algorithm name corresponding to the
// crypto.Hash ID, or an error if the algorithm is not supported.
func CryptoHashToDigestName(id crypto.Hash) (result string, err error) {
	var supported bool
	if result, supported = algorithmName[id]; !supported {
		err = fmt.Errorf("hmacauth: unsupported crypto.Hash #%d", id)
	}
	return
}

type hmacAuth struct {
	hash    crypto.Hash
	key     []byte

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Use a supported lowercase algorithm name such as sha1 or sha256 as configured in supportedAlgorithms
2. Check the exact algorithm the upstream signer uses and match it verbatim (lowercase, no hyphens)
3. Update oauth2-proxy to a version whose supportedAlgorithms includes the needed hash, or patch the map

Example fix

// before
auth, err := hmacauth.NewHmacAuth("SHA256", []byte(key))
// after
auth, err := hmacauth.NewHmacAuth("sha256", []byte(key))

if err := hmacauth.TestSupportedHashAlgorithm(alg); err != nil {
	return fmt.Errorf("unsupported signature algorithm %q: %w", alg, err)
}

h, err := hmacauth.DigestNameToCryptoHash(name)
if err != nil {
	return fmt.Errorf("fallback to sha256 for %q: %w", name, err)
}

When it happens

Trigger: parseSignatureKey or AuthenticateRequest receives a signature algorithm name not present in supportedAlgorithms, e.g. "sha512-256", "SHA256" (uppercase) or a misspelled name.

Common situations: Upstream service signs with an algorithm oauth2-proxy does not support; config uses uppercase or hyphenated names; docs/version drift between the signer and verifier.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• error initialising cipher: %v
• could not read cookie secret file
• no configuration file provided
• secret source is invalid: exactly one entry required, specif
• error creating a session ticket: %v

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/70da913ba2d68be2. Report an issue: GitHub.