oauth2-proxy/oauth2-proxy · error

hmacauth: unsupported crypto.Hash #%d

Error message

hmacauth: unsupported crypto.Hash #%d

What it means

CryptoHashToDigestName in pkg/authentication/hmacauth maps a crypto.Hash ID to its digest name (e.g. SHA256) via the algorithmName lookup table; unsupported IDs produce this error. Callers using HMAC signature validation with a hash the library has no name mapping for get this failure.

Source

Thrown at pkg/authentication/hmacauth/hmacauth.go:82

}

// DigestNameToCryptoHash returns the crypto.Hash value corresponding to the
// algorithm name, or an error if the algorithm is not supported.
func DigestNameToCryptoHash(name string) (result crypto.Hash, err error) {
	var supported bool
	if result, supported = supportedAlgorithms[name]; !supported {
		err = errors.New("hmacauth: hash algorithm not supported: " +
			name)
	}
	return
}

// CryptoHashToDigestName returns the algorithm name corresponding to the
// crypto.Hash ID, or an error if the algorithm is not supported.
func CryptoHashToDigestName(id crypto.Hash) (result string, err error) {
	var supported bool
	if result, supported = algorithmName[id]; !supported {
		err = fmt.Errorf("hmacauth: unsupported crypto.Hash #%d", id)
	}
	return
}

type hmacAuth struct {
	hash    crypto.Hash
	key     []byte
	header  string
	headers []string
}

// NewHmacAuth returns an HmacAuth object that can be used to sign or
// authenticate HTTP requests based on the supplied parameters.
func NewHmacAuth(hash crypto.Hash, key []byte, header string,
	headers []string) HmacAuth {
	if !hash.Available() {
		var name string
		var supported bool

View on GitHub (pinned to 33c2eb92de)

Solutions

1. Use a supported hash such as crypto.SHA256 when building the hmacauth session
2. Check the algorithmName map in hmacauth.go for the list of supported crypto.Hash values
3. Update oauth2-proxy to a version whose algorithmName map includes your hash, if a newer one added it
4. If you must use another algorithm, add it to the algorithmName map in a fork/patch

Example fix

// before
session, err := hmacauth.NewHMACAuth(crypto.MD5, key)
// after
session, err := hmacauth.NewHMACAuth(crypto.SHA256, key)

switch hash {
case crypto.SHA256, crypto.SHA384, crypto.SHA512:
	// supported by hmacauth
default:
	return fmt.Errorf("hash %v not supported by hmacauth", hash)
}

func isSupportedHash(id crypto.Hash) bool {
	_, ok := algorithmName[id]
	return ok
}

name, err := hmacauth.CryptoHashToDigestName(hash)
if err != nil {
	// fall back to crypto.SHA256 or reject the configuration
	return err
}

When it happens

Trigger: Calling CryptoHashToDigestName with a crypto.Hash value not present in the algorithmName map — e.g. MD5, or a newer/less-common hash — when constructing an HMAC auth session.

Common situations: Configuring an HMAC signature header algorithm with crypto.MD5 or another unsupported hash; library updated to a crypto.Hash constant the map doesn't cover; mixing code that assumes all crypto.Hash values are supported.

Related errors

• hmacauth: hash algorithm not supported: name
• cookie signature not valid
• hmacauth: hash algorithm %s is unavailable

AI-assisted analysis of oauth2-proxy/oauth2-proxy@33c2eb92de (2026-09-06). Data as JSON: /api/errors/b13c249f18cf00fc. Report an issue: GitHub.