node.jsgoogle-cloud-storagegoogle-api-nodejs-client

Error: error:1E08010C:DECODER routines::unsupported with Google auth library


I've recently ran into this error with the google cloud storage SDK on Node.js. I know for a fact that this worked in the past without any changes, but I haven't touched the code in a while and might be wrong.

Here's the error itself:

Error: error:1E08010C:DECODER routines::unsupported
    at Sign.sign (node:internal/crypto/sig:131:29)
    at Object.sign (node_modules/jwa/index.js:152:45)
    at Object.jwsSign [as sign] (node_modules/jws/lib/sign-stream.js:32:24)
    at GoogleToken.requestToken (node_modules/gtoken/build/src/index.js:232:31)
    at GoogleToken.getTokenAsyncInner (node_modules/gtoken/build/src/index.js:166:21)
    at GoogleToken.getTokenAsync (node_modules/gtoken/build/src/index.js:145:55)
    at GoogleToken.getToken (node_modules/gtoken/build/src/index.js:97:21)
    at JWT.refreshTokenNoCache (node_modules/google-auth-library/build/src/auth/jwtclient.js:172:36)
    at JWT.refreshToken (node_modules/google-auth-library/build/src/auth/oauth2client.js:153:24)
    at JWT.getRequestMetadataAsync (node_modules/google-auth-library/build/src/auth/oauth2client.js:298:28) {
  library: 'DECODER routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_UNSUPPORTED'
}

The code that throws this error is the following:

const credentials = {
    type: process.env.TYPE,
    project_id: process.env.PROJECT_ID,
    private_key_id: process.env.PRIVATE_KEY_ID,
    private_key: process.env.PRIVATE_KEY,
    client_email: process.env.CLIENT_EMAIL,
    client_id: process.env.CLIENT_ID,
    auth_uri: process.env.AUTH_URI,
    token_uri: process.env.TOKEN_URI,
    auth_provider_x509_cert_url: process.env.AUTH_PROVIDER_X509_CERT_URL,
    client_x509_cert_url: process.env.CLIENT_X509_CERT_URL,
  };

  const storage = new Storage({
    credentials,
  });
  if (!req.file) {
    logger('POST /profile_image', logLevels.error, 'No file uploaded!');
    ResponseError.badRequest(res);
  }
  const bucketName = process.env.BUCKET_NAME;
  const bucket = storage.bucket(bucketName);
  const fileName = `profile_pics/${req.user}/${req.file.originalname}`;
  const file = bucket.file(fileName);
  const stream = file.createWriteStream({
    metadata: {
      contentType: req.file.mimetype,
    },
  });
  stream.on('error', (err) => {
    console.error('Error pushing the picture: ', err); <--- error
    throw err;
  });
  stream.on('finish', () => {
    return file.makePublic().then(async () => {
       ...
      })
  });
  stream.end(req.file.buffer);

The process.env contains all the right values, I've made sure to try with a new private key but same error. Has anyone seen this one before?

TIA!


Solution

  • Answering this as community wiki. As mentioned above in comments by John Hanley

    1. Do not store service accounts in environment variables.
    2. If you do, do not break the service account into pieces. Base64 encode the entire service account, store it in a variable, and then Base64 decode it when required.
    3. Your code is failing because the client is being set up with bad credentials. Most likely a corrupted private key.