alibaba/nacos · error · AccessException
unsupported signature algorithm
Error message
unsupported signature algorithm
What it means
Thrown by NacosSignatureAlgorithm.verify() as an AccessException when the JWT header does not match any registered Nacos signature algorithm. Nacos only recognizes HS256, HS384, and HS512 (looked up by their pre-encoded base64url header constants); any other algorithm header (e.g., RS256, none, or an unrecognized HS variant) is rejected.
Source
Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java:111
* @param key for signature
* @return object for payload
* @throws AccessException access exception
*/
public static NacosUser verify(String jwt, Key key) throws AccessException {
if (StringUtils.isBlank(jwt)) {
throw new AccessException("user not found!");
}
String[] split = jwt.split("\\.");
if (split.length != JWT_PARTS) {
throw new AccessException("token invalid!");
}
String header = split[HEADER_POSITION];
String payload = split[PAYLOAD_POSITION];
String signature = split[SIGNATURE_POSITION];
NacosSignatureAlgorithm signatureAlgorithm = MAP.get(header);
if (signatureAlgorithm == null) {
throw new AccessException("unsupported signature algorithm");
}
NacosUser user = signatureAlgorithm.verify(header, payload, signature, key);
user.setToken(jwt);
return user;
}
/**
* verify jwt.
*
* @param header header of jwt
* @param payload payload of jwt
* @param signature signature of jwt
* @param key for signature
* @return object for payload
* @throws AccessException access exception
*/
public NacosUser verify(String header, String payload, String signature, Key key)
throws AccessException {View on GitHub (pinned to 9b989acdf1)
Solutions
- Use a token issued by Nacos itself (signed with the configured HS secret key).
- If federating via OIDC, exchange/mint a locally-signed HS token rather than passing the IdP token directly.
- Confirm the token alg is HS256/HS384/HS512 (decode the header at jwt.io to inspect).
Example fix
// before: client presents an RS256 IdP token Authorization: Bearer <rs256-idp-token> // -> unsupported signature algorithm // after: exchange for a Nacos-issued HS256 token Authorization: Bearer <nacos-accessToken>
Defensive patterns
Strategy: validation
Validate before calling
String[] parts = jwt.split("\\.");
String headerJson = new String(Base64.getUrlDecoder().decode(parts[0]), StandardCharsets.UTF_8);
String alg = JacksonUtils.toObj(headerJson, Map.class).get("alg").toString();
if (!Set.of("HS256", "HS384", "HS512").contains(alg)) {
throw new AccessException("unsupported signature algorithm: " + alg);
} Try / catch
try {
NacosSignatureAlgorithm.verify(jwt, key);
} catch (AccessException e) {
if ("unsupported signature algorithm".equals(e.getMessage())) {
// exchange external IdP token for a Nacos HS token
}
throw e;
} Prevention
- Only present HS256/HS384/HS512 tokens to Nacos verify().
- For federated auth, mint a local HS token rather than passing an RS token.
- Decode the token header during debugging to confirm the alg.
When it happens
Trigger: MAP.get(header) returns null because the token's base64url-encoded header does not equal the HS256/HS384/HS512 header constant; e.g., an RS256-signed token or a token with extra header fields that change the base64 encoding.
Common situations: A third-party IdP issued an RS256/RS512 token that the client presents to Nacos; the token header includes custom claims that alter its encoding; mixing tokens from a different JWT library.
Related errors
AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14).
Data as JSON: /api/errors/c208648285230271.
Report an issue: GitHub.