{"record":{"id":"08abea37fff172e7","repo":"lcobucci/jwt","slug":"the-claim-claim-does-not-have-the-expected-value","errorCode":null,"errorMessage":"The claim \"{claim}\" does not have the expected value","messagePattern":"The claim \"(.+?)\" does not have the expected value","errorType":"exception","errorClass":"Lcobucci\\JWT\\Validation\\ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/HasClaimWithValue.php","lineNumber":36,"sourceCode":"        if (in_array($claim, Token\\RegisteredClaims::ALL, true)) {\n            throw CannotValidateARegisteredClaim::create($claim);\n        }\n    }\n\n    public function assert(Token $token): void\n    {\n        if (! $token instanceof UnencryptedToken) {\n            throw ConstraintViolation::error('You should pass a plain token', $this);\n        }\n\n        $claims = $token->claims();\n\n        if (! $claims->has($this->claim)) {\n            throw ConstraintViolation::error('The token does not have the claim \"' . $this->claim . '\"', $this);\n        }\n\n        if ($claims->get($this->claim) !== $this->expectedValue) {\n            throw ConstraintViolation::error(\n                'The claim \"' . $this->claim . '\" does not have the expected value',\n                $this,\n            );\n        }\n    }\n}\n","sourceCodeStart":18,"sourceCodeEnd":43,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/HasClaimWithValue.php#L18-L43","documentation":"The claim exists but its value is not identical (===) to the expected value supplied to HasClaimWithValue, so it throws ConstraintViolation 'The claim \"...\" does not have the expected value'. Comparison is strict, so type differences (e.g. int 1 vs string \"1\") also trigger it.","triggerScenarios":"(new HasClaimWithValue('role', 'admin'))->assert($token) where claims contain role='user' or role=123 vs '123' (strict inequality).","commonSituations":"Role/permission drift between token issuance and authorization checks; scalar type mismatches (JSON numbers vs strings) between issuer and validator; multi-environment token differences.","solutions":["Align the expected value (and its PHP type) with what the issuer actually encodes","Fix the issuer configuration so it emits the correct value","Loosen to a manual comparison (==) or normalize types before validating if strict identity is undesired"],"exampleFix":"// before\nnew HasClaimWithValue('role', 'admin'); // token has \"role\": \"Admin\"\n// after\nnew HasClaimWithValue('role', 'Admin'); // match issuer casing/value exactly","handlingStrategy":"try-catch","validationCode":"$actual = $token->claims()->get('role');\nif ($actual !== 'admin') { /* expected value/type mismatch */ }","typeGuard":null,"tryCatchPattern":"try {\n    $validator->assert($token, new HasClaimWithValue('role', 'admin'));\n} catch (RequiredConstraintsViolated $e) {\n    // value mismatch; deny authorization\n}","preventionTips":["Match the exact value AND PHP type the issuer encodes","Centralize expected claim values in config shared with the issuer","Remember comparison is strict (===): '1' !== 1"],"tags":["jwt","validation","claims","value-mismatch"],"backgroundTag":"schema-validation-failed","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}