BookStackApp/BookStack · error · OidcInvalidTokenException

Only RS256 signature validation is supported. Token reports

Error message

Only RS256 signature validation is supported. Token reports using {$this->header['alg']}

What it means

OidcJwtWithClaims::validateTokenSignature only supports RS256 (RSA + SHA-256). Before verifying, it reads the token header's 'alg' claim and throws OidcInvalidTokenException for anything else (HS256, ES256, RS384, none, etc.), since the library only loads RSA signing keys and verifies with PKCS1 padding.

Source

Thrown at app/Access/Oidc/OidcJwtWithClaims.php:123

            if (empty($this->$prop)) {
                throw new OidcInvalidTokenException("Could not parse out a valid {$prop} within the provided token");
            }
        }

        if (empty($this->signature)) {
            throw new OidcInvalidTokenException('Could not parse out a valid signature within the provided token');
        }
    }

    /**
     * Validate the signature of the given token and ensure it validates against the provided key.
     *
     * @throws OidcInvalidTokenException
     */
    protected function validateTokenSignature(): void
    {
        if ($this->header['alg'] !== 'RS256') {
            throw new OidcInvalidTokenException("Only RS256 signature validation is supported. Token reports using {$this->header['alg']}");
        }

        $parsedKeys = array_map(function ($key) {
            try {
                return new OidcJwtSigningKey($key);
            } catch (OidcInvalidKeyException $e) {
                throw new OidcInvalidTokenException('Failed to read signing key with error: ' . $e->getMessage());
            }
        }, $this->keys);

        $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
        /** @var OidcJwtSigningKey $parsedKey */
        foreach ($parsedKeys as $parsedKey) {
            if ($parsedKey->verify($contentToSign, $this->signature)) {
                return;
            }
        }

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Reconfigure the identity provider to sign id_tokens with RS256
2. If using a provider with per-client algorithm settings, set the client's token signing algorithm to RS256
3. Check the reported alg in the error to confirm which unsupported algorithm is in use and align provider docs accordingly

function tokenAlg(string $idToken): ?string {
    $h = json_decode(base64_decode(strtr(explode('.', $idToken)[0] ?? '', '-_', '+/') ?: '', true) ?: '', true);
    return is_array($h) ? ($h['alg'] ?? null) : null;
}
// call before validating: if (tokenAlg($idToken) !== 'RS256') { abort with config guidance }

function isRs256Token(array $header): bool { return ($header['alg'] ?? null) === 'RS256'; }

try {
    $jwt->validate($token);
} catch (\BookStack\Access\Oidc\OidcInvalidTokenException $e) {
    if (str_contains($e->getMessage(), 'RS256')) {
        // IdP signing alg mismatch: reconfigure provider to RS256
    }
}

When it happens

Trigger: The OIDC provider issues id_tokens with an alg other than RS256 in the JWT header, and that token reaches validateTokenSignature during validateCommonTokenDetails.

Common situations: IdP default algorithm set to HS256 (client-secret-based) or ES256; provider tenant misconfiguration; switching IdPs or upgrading a provider that changed its default signing algorithm.

Related errors

• Could not parse out a valid {$prop} within the provided toke
• Could not parse out a valid signature within the provided to
• Failed to read signing key with error:
• Token signature could not be validated using the provided ke
• Missing or non-matching token issuer value

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/42d24f11fb3d0d42. Report an issue: GitHub.