fix: correctly parse JWT ValidMethods from env by enabling split_words by singh-inder · Pull Request #2334 · supabase/auth

singh-inder · 2026-01-16T23:38:40Z

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

JWT ValidMethods not parsed from env because split_words was missing on the struct tag, causing envconfig to look for GOTRUE_JWT_VALIDMETHODS instead of GOTRUE_JWT_VALID_METHODS. Since v2.71.1, cli defaults to asymmetric keys, which caused valid HS256 tokens to be rejected.

What is the new behavior?

This change adds split_words to ensure the correct env var is used. I assume that GOTRUE_JWT_VALID_METHODS is the correct env var but if it isn't, then this issue can also be solved by updating the env var passed to auth service in supabase cli to

			env = append(env, "GOTRUE_JWT_VALIDMETHODS=HS256,RS256,ES256")

Additional context

The following screenshots are from print statements I added

config.JWT.ValidMethods was nil because it was looking for wrong env var. It defaulted to jwk key algorithm (ES256).

auth/internal/conf/configuration.go

Lines 1092 to 1097 in 645654d

    
           if config.JWT.ValidMethods == nil { 
        
           	config.JWT.ValidMethods = []string{} 
        
           	for _, key := range config.JWT.Keys { 
        
           		alg := GetSigningAlg(key.PublicKey) 
        
           		config.JWT.ValidMethods = append(config.JWT.ValidMethods, alg.Alg()) 
        
           	}

After

singh-inder · 2026-01-17T00:12:21Z

Maybe related:
https://github.com/orgs/supabase/discussions/41895
supabase/cli#4726

coveralls · 2026-01-19T09:55:17Z

Pull Request Test Coverage Report for Build 22099601302

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 69.034%

Totals
Change from base Build 22075658585:	0.0%
Covered Lines:	14941
Relevant Lines:	21643

💛 - Coveralls

aantti · 2026-01-19T09:55:44Z

Also supabase/cli#4524 ?

aantti · 2026-01-19T10:14:50Z

@hf @kangmingtay

aantti · 2026-01-21T17:01:52Z

Possibly also supabase/supabase#42037

singh-inder · 2026-02-08T13:16:06Z

Closing this for now to avoid confusion with env var name. For reference: supabase/cli#4818 (comment)

cemalkilic · 2026-02-17T08:44:15Z

Hi @singh-inder, thanks for the contribution! can you please rebase the master? Then we can get this merged

coderabbitai · 2026-02-17T13:05:21Z

No actionable comments were generated in the recent review. 🎉

📝 Walkthrough

Summary by CodeRabbit

Chores
- Improved configuration parsing for JWT-related settings to enhance consistency with environment variable handling.

Walkthrough

The ValidMethods field in the JWTConfiguration struct has been updated with an additional struct tag. The field's tag was changed from json:"-" to json:"-" split_words:"true". This modification adds configuration parsing behavior for handling environment variables with word splitting, while maintaining the existing JSON serialization behavior of excluding this field from JSON marshaling/unmarshaling.

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

singh-inder · 2026-02-17T13:08:54Z

Hi @cemalkilic, Thanks for the review. I've rebased on master.

🤖 I have created a release *beep* *boop* --- ## [2.187.0](v2.186.0...v2.187.0) (2026-02-23) ### Features * add metadata field to all hooks ([#2365](#2365)) ([c675749](c675749)) * check current password on change ([#2364](#2364)) ([33b87ae](33b87ae)) * **indexworker:** add max users threshold for rollout ([#2374](#2374)) ([a2066c6](a2066c6)) * **metrics:** added a gauge with version information ([#2375](#2375)) ([911ad0b](911ad0b)) * support custom oauth & oidc providers ([#2357](#2357)) ([53021f6](53021f6)) ### Bug Fixes * case-insensitive Bearer token scheme matching ([#2387](#2387)) ([36d712d](36d712d)) * correctly parse JWT ValidMethods from env by enabling split_words ([#2334](#2334)) ([a6076bc](a6076bc)) * flaky index worker test ([#2366](#2366)) ([961a7e6](961a7e6)) * **hooks:** propagate error objects from hook calls ([#2380](#2380)) ([3ca1e88](3ca1e88)) * session upgrade percentage should be based on session, not request ([#2371](#2371)) ([510e68b](510e68b)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>

singh-inder requested a review from a team as a code owner January 16, 2026 23:38

sweatybridge mentioned this pull request Jan 30, 2026

fix: set correct valid methods env var supabase/cli#4781

Merged

aantti added the auth label Feb 4, 2026

aantti assigned cemalkilic Feb 4, 2026

Roozbehy mentioned this pull request Feb 7, 2026

JWT validation broken: GOTRUE_JWT_VALIDMETHODS env var not recognized by GoTrue v2.186.0 supabase/cli#4817

Closed

singh-inder closed this Feb 8, 2026

singh-inder reopened this Feb 16, 2026

fix: correctly parse JWT ValidMethods from env by enabling split_words

9400a53

singh-inder force-pushed the fix/valid-methods-parsing branch from 11ab4b6 to 9400a53 Compare February 17, 2026 13:05

cemalkilic mentioned this pull request Feb 19, 2026

fix(auth): pass GOTRUE_JWT_VALID_METHODS env var for GoTrue compat supabase/cli#4874

Merged

cemalkilic approved these changes Feb 19, 2026

View reviewed changes

cemalkilic merged commit a6076bc into supabase:master Feb 19, 2026
4 checks passed

supabase-releaser bot mentioned this pull request Feb 18, 2026

chore(master): release 2.187.0 #2367

Merged

singh-inder deleted the fix/valid-methods-parsing branch February 19, 2026 07:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: correctly parse JWT ValidMethods from env by enabling split_words#2334

fix: correctly parse JWT ValidMethods from env by enabling split_words#2334
cemalkilic merged 1 commit intosupabase:masterfrom
singh-inder:fix/valid-methods-parsing

singh-inder commented Jan 16, 2026 •

edited

Loading

Uh oh!

singh-inder commented Jan 17, 2026

Uh oh!

coveralls commented Jan 19, 2026 •

edited

Loading

Uh oh!

aantti commented Jan 19, 2026

Uh oh!

aantti commented Jan 19, 2026

Uh oh!

aantti commented Jan 21, 2026

Uh oh!

singh-inder commented Feb 8, 2026

Uh oh!

cemalkilic commented Feb 17, 2026

Uh oh!

coderabbitai bot commented Feb 17, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Uh oh!

singh-inder commented Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	if config.JWT.ValidMethods == nil {
	config.JWT.ValidMethods = []string{}
	for _, key := range config.JWT.Keys {
	alg := GetSigningAlg(key.PublicKey)
	config.JWT.ValidMethods = append(config.JWT.ValidMethods, alg.Alg())
	}

Conversation

singh-inder commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior?

Additional context

Uh oh!

singh-inder commented Jan 17, 2026

Uh oh!

coveralls commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 22099601302

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

aantti commented Jan 19, 2026

Uh oh!

aantti commented Jan 19, 2026

Uh oh!

aantti commented Jan 21, 2026

Uh oh!

singh-inder commented Feb 8, 2026

Uh oh!

cemalkilic commented Feb 17, 2026

Uh oh!

coderabbitai bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Uh oh!

singh-inder commented Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

singh-inder commented Jan 16, 2026 •

edited

Loading

coveralls commented Jan 19, 2026 •

edited

Loading

coderabbitai bot commented Feb 17, 2026 •

edited

Loading