{"record":{"id":"19f4c8d0a9d4ed16","repo":"lcobucci/jwt","slug":"key-cannot-be-empty","errorCode":null,"errorMessage":"Key cannot be empty","messagePattern":"Key cannot be empty","errorType":"exception","errorClass":"Lcobucci\\JWT\\Signer\\InvalidKeyProvided","httpStatus":null,"severity":"error","filePath":"src/Signer/Key/InMemory.php","lineNumber":85,"sourceCode":"            $file = new SplFileObject($path);\n        } catch (Throwable $exception) {\n            throw FileCouldNotBeRead::onPath($path, $exception);\n        }\n\n        $fileSize = $file->getSize();\n        $contents = $fileSize > 0 ? $file->fread($file->getSize()) : '';\n        assert(is_string($contents));\n\n        self::guardAgainstEmptyKey($contents);\n\n        return new self($contents, $passphrase);\n    }\n\n    /** @phpstan-assert non-empty-string $contents */\n    private static function guardAgainstEmptyKey(string $contents): void\n    {\n        if ($contents === '') {\n            throw InvalidKeyProvided::cannotBeEmpty();\n        }\n    }\n\n    public function contents(): string\n    {\n        return $this->contents;\n    }\n\n    public function passphrase(): string\n    {\n        return $this->passphrase;\n    }\n}\n","sourceCodeStart":67,"sourceCodeEnd":99,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Signer/Key/InMemory.php#L67-L99","documentation":"Thrown by InMemory::guardAgainstEmptyKey() when the key contents resolve to an empty string. InMemory deliberately refuses to construct keys from empty material, since an empty signing key is never valid.","triggerScenarios":"InMemory::plainText(''), InMemory::base64Encoded(''), or InMemory::file() reading a zero-byte file; also an env var or config value that resolves to '' being passed to the key factory.","commonSituations":"Missing environment variable returning empty string, empty file mounted as a secret (e.g. K8s secret not populated), base64 of an empty string, config file with KEY= empty.","solutions":["Ensure the key source (env var, file, config) is populated with non-empty contents","Check the mounted secret file is non-empty: `wc -c /run/secrets/jwt_key`","Fail fast at boot: validate the key string before constructing InMemory","Fix quoting/interpolation issues in .env or deployment manifests that drop the value"],"exampleFix":"// before\n$key = InMemory::plainText($_ENV['JWT_SECRET'] ?? '');\n// after\n$secret = $_ENV['JWT_SECRET'] ?? '';\nif ($secret === '') {\n    throw new RuntimeException('JWT_SECRET is not set');\n}\n$key = InMemory::plainText($secret);","handlingStrategy":"validation","validationCode":"if (!is_string($secret) || $secret === '') { throw new RuntimeException('JWT key is empty or not set'); }","typeGuard":null,"tryCatchPattern":"try { $key = InMemory::plainText($secret); } catch (\\Jose\\Component\\Signature\\Exception\\InvalidKeyProvided $e) { /* config error: empty key */ }","preventionTips":["Fail fast on empty env vars/config values at boot","Verify secret file sizes after mounting (non-zero)","Never default key config values to ''"],"tags":["key","empty-value","configuration","jwt"],"backgroundTag":"empty-required-field","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}