BookStackApp/BookStack · error · OidcInvalidKeyException

An "e" parameter on the provided key is expected

Error message

An "e" parameter on the provided key is expected

What it means

Validation guard in OidcJwtSigningKey::loadFromJwkArray that rejects a JWK missing the RSA public exponent parameter 'e'. Fires when an OIDC discovery document supplies an RSA signing key whose 'e' field is absent, meaning the key cannot be used to verify JWT RS256 signatures.

Source

Thrown at app/Access/Oidc/OidcJwtSigningKey.php:73

     */
    protected function loadFromJwkArray(array $jwk): void
    {
        // 'alg' is optional for a JWK, but we will still attempt to validate if
        // it exists otherwise presume it will be compatible.
        $alg = $jwk['alg'] ?? null;
        if ($jwk['kty'] !== 'RSA' || !(is_null($alg) || $alg === 'RS256')) {
            throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$alg}");
        }

        // 'use' is optional for a JWK but we assume 'sig' where no value exists since that's what
        // the OIDC discovery spec infers since 'sig' MUST be set if encryption keys come into play.
        $use = $jwk['use'] ?? 'sig';
        if ($use !== 'sig') {
            throw new OidcInvalidKeyException("Only signature keys are currently supported. Found key for use {$jwk['use']}");
        }

        if (empty($jwk['e'])) {
            throw new OidcInvalidKeyException('An "e" parameter on the provided key is expected');
        }

        if (empty($jwk['n'])) {
            throw new OidcInvalidKeyException('A "n" parameter on the provided key is expected');
        }

        $n = strtr($jwk['n'], '-_', '+/');

        try {
            $key = PublicKeyLoader::load([
                'e' => new BigInteger(base64_decode($jwk['e']), 256),
                'n' => new BigInteger(base64_decode($n), 256),
            ]);
        } catch (\Exception $exception) {
            throw new OidcInvalidKeyException("Failed to load key from JWK parameters with error: {$exception->getMessage()}");
        }

        if (!$key instanceof RSA) {

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Include 'e' (typically 'AQAB') in the JWK array
2. Re-fetch the full JWK from the IdP's jwks_uri instead of copying partial data
3. Check persistence/config isn't truncating the stored JWK
4. For fixtures, add 'e' => 'AQAB'

Example fix

// before
['kty' => 'RSA', 'n' => $n, 'use' => 'sig']
// after
['kty' => 'RSA', 'n' => $n, 'e' => 'AQAB', 'use' => 'sig']

if (empty($jwk['e'])) { throw new \RuntimeException('JWK missing e parameter'); }

function hasRsaPublicParams(array $jwk): bool { return !empty($jwk['e']) && !empty($jwk['n']); }

try { $key = new OidcJwtSigningKey($jwk); } catch (OidcInvalidKeyException $e) { if (str_contains($e->getMessage(), '"e" parameter')) { /* refetch full JWK */ } throw $e; }

When it happens

Trigger: new OidcJwtSigningKey($jwkArray) with an RSA/sig JWK lacking 'e', or with 'e' set to an empty string/null.

Common situations: Hand-written or partially copied JWK fixtures; a JWKS publisher omitting 'e'; destructuring/extracting only 'n' and 'kty'; truncation when storing the JWK in config/DB.

Related errors

• A "n" parameter on the provided key is expected
• Failed to load key from JWK parameters with error: {$excepti
• Key loaded from file path is not an RSA key as expected
• Only RS256 keys are currently supported. Found key using {$a
• Only signature keys are currently supported. Found key for u

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/c871311723ac93ac. Report an issue: GitHub.