ory/hydra · error

value is out of range

Error message

value is out of range

What it means

GetTime in oryx/mapx/type_assert.go returns this ad-hoc error when a float64 value (e.g. a JSON-decoded Unix timestamp) exceeds the representable range of int64, so converting it via time.Unix would overflow. The check is v < math.MinInt64 || v > math.MaxInt64. It protects callers from silently creating an invalid/wrapped time value.

Source

Thrown at oryx/mapx/type_assert.go:71

// GetTime returns a string slice for a given key in values.
func GetTime[K comparable](values map[K]any, key K) (time.Time, error) {
	v, ok := values[key]
	if !ok {
		return time.Time{}, ErrKeyDoesNotExist
	}

	switch v := v.(type) {
	case time.Time:
		return v, nil
	case int64:
		return time.Unix(v, 0), nil
	case int32:
		return time.Unix(int64(v), 0), nil
	case int:
		return time.Unix(int64(v), 0), nil
	case float64:
		if v < math.MinInt64 || v > math.MaxInt64 {
			return time.Time{}, errors.New("value is out of range")
		}
		return time.Unix(int64(v), 0), nil
	case float32:
		if v < math.MinInt64 || v > math.MaxInt64 {
			return time.Time{}, errors.New("value is out of range")
		}
		return time.Unix(int64(v), 0), nil
	}

	return time.Time{}, ErrKeyCanNotBeTypeAsserted
}

// GetInt64 returns an int64 for a given key in values.
func GetInt64[K comparable](values map[K]any, key K) (int64, error) {
	v, ok := values[key]
	if !ok {
		return 0, ErrKeyDoesNotExist
	}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Validate the numeric magnitude before calling GetTime (clamp or reject values outside int64 range).
2. Guard the call and treat the out-of-range error as invalid token/data input (reject the claim).
3. Fix the data source so timestamps are sane Unix seconds/milliseconds.
4. If milliseconds are expected, divide by 1000 before conversion so values fit in int64.

Example fix

// before
v, _ := claims["exp"].(float64)
t, err := mapx.GetTime(claims, "exp")
// after
if v, ok := claims["exp"].(float64); ok && v >= math.MinInt64 && v <= math.MaxInt64 {
    t, err := mapx.GetTime(claims, "exp")
    _ = t
}

if v, ok := claims["exp"].(float64); !ok || v < math.MinInt64 || v > math.MaxInt64 {
    // reject or clamp before calling mapx.GetTime
}

func safeTimestamp(v any) (float64, bool) {
    f, ok := v.(float64)
    if !ok || f < math.MinInt64 || f > math.MaxInt64 {
        return 0, false
    }
    return f, true
}

t, err := mapx.GetTime(claims, "exp")
if err != nil && err.Error() == "value is out of range" {
    // treat as invalid timestamp: reject token/claim
}

When it happens

Trigger: Calling mapx.GetTime on a map value of type float64 whose magnitude is larger than math.MaxInt64 or smaller than math.MinInt64 (line 71 of type_assert.go).

Common situations: Corrupt or maliciously crafted JWT 'exp'/'iat'/'nbf' claims holding astronomically large float values; decoding binary or scientific-notation numbers as float64; unit tests with sentinel values like 1e300.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• ErrKeyCanNotBeTypeAsserted
• cookiex: cookie could not be decoded
• cookiex: purpose must be non-empty and must not contain a pi
• cookiex: at least one secret is required
• invalid elliptic curve key size, this algorithm does not sup

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/c76c4b1fca2050b5. Report an issue: GitHub.