starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-25 07:56:05 +03:00

[GH-ISSUE #516] unexpected JWT alg received #333

New issue

Open

opened 2026-03-02 11:48:56 +03:00 by kerem · 4 comments

kerem commented

2026-03-02 11:48:56 +03:00

Owner

Originally created by @DevGoran on GitHub (Oct 8, 2024).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/516

I setup hoarder with nginx and authentik and am receiving the following error:

message: 'unexpected JWT alg received, expected RS256, got: ES256'

Authentik and nginx are using certificates generated by certbot (which shows as ECC in authentik).

When not using my own domain and just using the IP:Port and the authentik self signed certificate, everything works fine.

Is there any way to use my certbot certificates?

Originally created by @DevGoran on GitHub (Oct 8, 2024). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/516 I setup hoarder with nginx and authentik and am receiving the following error: message: 'unexpected JWT alg received, expected RS256, got: ES256' Authentik and nginx are using certificates generated by certbot (which shows as ECC in authentik). When not using my own domain and just using the IP:Port and the authentik self signed certificate, everything works fine. Is there any way to use my certbot certificates?

kerem added the

question

label

2026-03-02 11:48:56 +03:00

kerem commented

2026-03-02 11:48:57 +03:00

Author

Owner

@ad3m3r5 commented on GitHub (Oct 30, 2024):

@DevGoran Here's how I got around that error:

Authentik -> Admin Interface -> Applications -> Providers -> <Your Hoarder Provider> -> Protocol settings -> Signing Key -> <Choose a Certificate>

e.g. "authentik Self-Signed Certificate"

I got the original information from here:

@ad3m3r5 commented on GitHub (Oct 30, 2024): @DevGoran Here's how I got around that error: Authentik -> Admin Interface -> Applications -> Providers -> `<Your Hoarder Provider>` -> Protocol settings -> Signing Key -> `<Choose a Certificate>` e.g. "authentik Self-Signed Certificate" I got the original information from here: - https://docs.goauthentik.io/docs/releases/2021.12#fixed-in-2021124 - https://github.com/goauthentik/authentik/issues/4824

kerem commented

2026-03-02 11:48:57 +03:00

Author

Owner

@wpeterw commented on GitHub (Dec 28, 2024):

I tried the solution provided by @ad3m3r5 but that doesn't work for me:

using "authentik Self-Signed Certificate":

`https://next-auth.js.org/errors#oauth_callback_error failed to decode JWT (TypeError: encrypted JWTs cannot be decoded) {

error: s: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded)

  at Z.validateJWT (/app/apps/web/.next/server/chunks/3632.js:36:8644)

  at Z.validateIdToken (/app/apps/web/.next/server/chunks/3632.js:36:6766)

  at Z.callback (/app/apps/web/.next/server/chunks/3632.js:36:3008)

  at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

  at async c (/app/apps/web/.next/server/chunks/3632.js:3:33292)

  at async Object.l (/app/apps/web/.next/server/chunks/3632.js:27:782)

  at async m (/app/apps/web/.next/server/chunks/3632.js:3:15621)

  at async o (/app/apps/web/.next/server/chunks/3632.js:27:19588)

  at async e.length.t (/app/apps/web/.next/server/chunks/3632.js:27:20999)

  at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:36957 {

name: 'OAuthCallbackError',

code: undefined

providerId: 'custom',

message: 'failed to decode JWT (TypeError: encrypted JWTs cannot be decoded)'

and using no signing key:

`https://next-auth.js.org/errors#oauth_callback_error unexpected JWT alg received, expected RS256, got: HS256 {

error: s: unexpected JWT alg received, expected RS256, got: HS256

  at Z.validateJWT (/app/apps/web/.next/server/chunks/3632.js:36:8736)

  at Z.validateIdToken (/app/apps/web/.next/server/chunks/3632.js:36:6766)

  at Z.callback (/app/apps/web/.next/server/chunks/3632.js:36:3008)

  at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

  at async c (/app/apps/web/.next/server/chunks/3632.js:3:33292)

  at async Object.l (/app/apps/web/.next/server/chunks/3632.js:27:782)

  at async m (/app/apps/web/.next/server/chunks/3632.js:3:15621)

  at async o (/app/apps/web/.next/server/chunks/3632.js:27:19588)

  at async e.length.t (/app/apps/web/.next/server/chunks/3632.js:27:20999)

  at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:36957 {

name: 'OAuthCallbackError',

code: undefined

providerId: 'custom',

message: 'unexpected JWT alg received, expected RS256, got: HS256'

@wpeterw commented on GitHub (Dec 28, 2024): I tried the solution provided by @ad3m3r5 but that doesn't work for me: using "authentik Self-Signed Certificate": `https://next-auth.js.org/errors#oauth_callback_error failed to decode JWT (TypeError: encrypted JWTs cannot be decoded) { error: s: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded) at Z.validateJWT (/app/apps/web/.next/server/chunks/3632.js:36:8644) at Z.validateIdToken (/app/apps/web/.next/server/chunks/3632.js:36:6766) at Z.callback (/app/apps/web/.next/server/chunks/3632.js:36:3008) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async c (/app/apps/web/.next/server/chunks/3632.js:3:33292) at async Object.l (/app/apps/web/.next/server/chunks/3632.js:27:782) at async m (/app/apps/web/.next/server/chunks/3632.js:3:15621) at async o (/app/apps/web/.next/server/chunks/3632.js:27:19588) at async e.length.t (/app/apps/web/.next/server/chunks/3632.js:27:20999) at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:36957 { name: 'OAuthCallbackError', code: undefined }, providerId: 'custom', message: 'failed to decode JWT (TypeError: encrypted JWTs cannot be decoded)' }` and using no signing key: `https://next-auth.js.org/errors#oauth_callback_error unexpected JWT alg received, expected RS256, got: HS256 { error: s: unexpected JWT alg received, expected RS256, got: HS256 at Z.validateJWT (/app/apps/web/.next/server/chunks/3632.js:36:8736) at Z.validateIdToken (/app/apps/web/.next/server/chunks/3632.js:36:6766) at Z.callback (/app/apps/web/.next/server/chunks/3632.js:36:3008) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async c (/app/apps/web/.next/server/chunks/3632.js:3:33292) at async Object.l (/app/apps/web/.next/server/chunks/3632.js:27:782) at async m (/app/apps/web/.next/server/chunks/3632.js:3:15621) at async o (/app/apps/web/.next/server/chunks/3632.js:27:19588) at async e.length.t (/app/apps/web/.next/server/chunks/3632.js:27:20999) at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:36957 { name: 'OAuthCallbackError', code: undefined }, providerId: 'custom', message: 'unexpected JWT alg received, expected RS256, got: HS256' }`

kerem commented

2026-03-02 11:48:57 +03:00

Author

Owner

@MrSliff commented on GitHub (Jan 29, 2025):

@wpeterw Did you set both, signature and encryption key in your provider settings?

I got the solution with only setting the signature key and leaving encryption key blank. After that automatic signup and login worked without errors (signup has to be enabled if you want to register a new account in hoarder via openid)

@MrSliff commented on GitHub (Jan 29, 2025): @wpeterw Did you set both, signature and encryption key in your provider settings? I got the solution with only setting the signature key and leaving encryption key blank. After that automatic signup and login worked without errors (signup has to be enabled if you want to register a new account in hoarder via openid)

kerem commented

2026-03-02 11:48:57 +03:00

Author

Owner

@dotlambda commented on GitHub (Dec 31, 2025):

It would be great if ES256 were supported out of the box as it's more secure than RS256.

@dotlambda commented on GitHub (Dec 31, 2025): It would be great if ES256 were supported out of the box as it's more secure than RS256.

kerem referenced this issue

2026-03-02 11:51:55 +03:00

[GH-ISSUE #1051] Publish RSS Feed #686

kerem referenced this issue

2026-03-02 11:59:28 +03:00

[PR #1507] [MERGED] feat: Generate RSS feeds from lists #1849

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#333

No description provided.

Rows
Columns