{"record":{"id":"1d314cecdcf364e7","repo":"justauth/JustAuth","slug":"unsupported-algorithm-algorithm","errorCode":null,"errorMessage":"Unsupported algorithm: ${algorithm}","messagePattern":"Unsupported algorithm: (.+?)","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/utils/GlobalAuthUtils.java","lineNumber":55,"sourceCode":"        byte[] signData = sign(secretKey.getBytes(DEFAULT_ENCODING), timestamp.getBytes(DEFAULT_ENCODING), HMAC_SHA_256);\n        return urlEncode(new String(Base64Utils.encode(signData, false)));\n    }\n\n    /**\n     * 签名\n     *\n     * @param key       key\n     * @param data      data\n     * @param algorithm algorithm\n     * @return byte[]\n     */\n    private static byte[] sign(byte[] key, byte[] data, String algorithm) {\n        try {\n            Mac mac = Mac.getInstance(algorithm);\n            mac.init(new SecretKeySpec(key, algorithm));\n            return mac.doFinal(data);\n        } catch (NoSuchAlgorithmException ex) {\n            throw new AuthException(\"Unsupported algorithm: \" + algorithm, ex);\n        } catch (InvalidKeyException ex) {\n            throw new AuthException(\"Invalid key: \" + Arrays.toString(key), ex);\n        }\n    }\n\n    /**\n     * 编码\n     *\n     * @param value str\n     * @return encode str\n     */\n    public static String urlEncode(String value) {\n        if (value == null) {\n            return \"\";\n        }\n        try {\n            String encoded = URLEncoder.encode(value, GlobalAuthUtils.DEFAULT_ENCODING.displayName());\n            return encoded.replace(\"+\", \"%20\").replace(\"*\", \"%2A\").replace(\"~\", \"%7E\").replace(\"/\", \"%2F\");","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/utils/GlobalAuthUtils.java#L37-L73","documentation":"Internal guard in GlobalAuthUtils.sign: Mac.getInstance(algorithm) threw NoSuchAlgorithmException, meaning the JVM has no provider offering the requested MAC algorithm. In stock JDKs the algorithms JustAuth requests (HmacSHA1/HmacSHA256 for signature building in Douyin/Twitter-style flows) always exist, so this error almost always indicates a stripped or custom runtime, or corrupted algorithm-name plumbing. Unlike the numbered AuthResponseStatus errors, this AuthException carries only the message 'Unsupported algorithm: <name>'.","triggerScenarios":"Running on a trimmed JRE (jlink runtime without jdk.crypto.ec / MAC services), an unusual JVM, or a security manager/provider setup where the HmacSHA* implementation was removed; theoretically also a future call site passing an unsupported algorithm string. Thrown while building signed request URLs (e.g. generate DingTalk/Douyin style signatures).","commonSituations":"Docker images based on minimal/alpine JREs that stripped crypto modules; custom Security.provider lists in java.security overriding defaults; FIPS-enabled runtimes restricting MAC algorithms; upgrading to a distro Java build with reduced crypto.","solutions":["Identify the algorithm from the message and confirm it is available: run a tiny main() that calls javax.crypto.Mac.getInstance(algorithm) on the same runtime.","Switch to a full JDK/JRE image (e.g. eclipse-temurin instead of a minimal variant) or add the missing provider/JDK module to the image.","Audit java.security / security provider config for entries that removed or reordered Mac providers.","If a custom provider is required, register it before first JustAuth use."],"exampleFix":"// diagnostics: run on the failing runtime\nMac mac = Mac.getInstance(\"HmacSHA256\"); // throws here => runtime lacks the algorithm\n// fix: use a full JDK base image\n// before: FROM alpine-jre-stripped\n// after:  FROM eclipse-temurin:21-jre","handlingStrategy":"try-catch","validationCode":"try { javax.crypto.Mac.getInstance(\"HmacSHA256\"); }\ncatch (NoSuchAlgorithmException e) { throw new IllegalStateException(\"JVM lacks HmacSHA256 — use a full JDK image\"); }","typeGuard":null,"tryCatchPattern":"catch (AuthException e) { if (e.getMessage() != null && e.getMessage().startsWith(\"Unsupported algorithm:\")) { /* runtime/crypto-provider problem — fix JVM, do not retry */ } }","preventionTips":["Run apps on standard JDK distributions (Temurin/Oracle/Zulu).","Add a startup smoke test asserting Mac.getInstance for the algorithms your platforms use.","Audit custom java.security provider lists when hardening images."],"tags":["java","justauth","crypto","jvm-runtime","hmac"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}