{"record":{"id":"1f9377e614428c56","repo":"jwtk/jjwt","slug":"wrap-e-jcaname-specifiedprovider-null","errorCode":null,"errorMessage":"wrap(e, jcaName, specifiedProvider, null)","messagePattern":"wrap\\(e, jcaName, specifiedProvider, null\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JcaTemplate.java","lineNumber":404,"sourceCode":"                    // and we haven't tried BC yet, so try that now:\n                    Provider fallback = findBouncyCastle();\n                    if (fallback != null) { // BC found, try again:\n                        try {\n                            T value = doGet(jcaName, fallback);\n                            // record the successful attempt so we don't have to do this again:\n                            FALLBACK_ATTEMPTS.putIfAbsent(jcaName, Boolean.TRUE);\n                            return value;\n                        } catch (Throwable ignored) {\n                            // record the failed attempt so we don't keep trying and propagate original exception:\n                            FALLBACK_ATTEMPTS.putIfAbsent(jcaName, Boolean.FALSE);\n                        }\n                    }\n                }\n                // otherwise, we tried the fallback, or there isn't a fallback, so no need to try again, so\n                // propagate the exception:\n                throw wrap(nsa, jcaName, specifiedProvider, null);\n            } catch (Exception e) {\n                throw wrap(e, jcaName, specifiedProvider, null);\n            }\n        }\n\n        protected abstract T doGet(String jcaName, Provider provider) throws Exception;\n\n        // visible for testing:\n        protected Exception wrap(Exception e, String jcaName, Provider specifiedProvider, Provider fallbackProvider) {\n            String msg = \"Unable to obtain '\" + jcaName + \"' \" + getId() + \" instance from \";\n            if (specifiedProvider != null) {\n                msg += \"specified '\" + specifiedProvider + \"' Provider\";\n            } else {\n                msg += \"default JCA Provider\";\n            }\n            if (fallbackProvider != null) {\n                msg += \" or fallback '\" + fallbackProvider + \"' Provider\";\n            }\n            msg += \": \" + e.getMessage();\n            return wrap(msg, e);","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JcaTemplate.java#L386-L422","documentation":"JcaTemplate.get wraps any unexpected Exception from the JCA call into a runtime security exception via wrap(e, jcaName, ...). Unlike the NoSuchAlgorithmException branch (268), this covers all other JCA failures: InvalidKeyException, InvalidAlgorithmParameterException, provider runtime errors, etc., annotated with the JCA name and provider attempted.","triggerScenarios":"Any exception thrown by the underlying JCA engine during doGet — e.g. a SecretKey derived with wrong parameters, a Cipher given an invalid key length, key strength exceeding crypto export policy, or a provider throwing a runtime error — during JWT sign/verify/encrypt/decrypt.","commonSituations":"AES keys of invalid length (e.g. 100-bit key), GCM params mismatch, signing with an EC key whose curve params were altered, provider misconfiguration, or hardware tokens returning errors.","solutions":["Inspect the wrapped cause (e.getCause()) — it names the real JCA failure (InvalidKeyException, InvalidAlgorithmParameterException, ...).","Validate key sizes/parameters before use (e.g. 256-bit AES keys, matching curve and algorithm).","Ensure the specified provider actually supports the jcaName transformation.","Catch the thrown runtime exception around Jwts.parser()/builder() calls and log the full cause chain."],"exampleFix":"// before\nSecretKey key = new SecretKeySpec(new byte[8], \"AES\"); // too short -> InvalidKeyException wrapped\n// after\nbyte[] bytes = new byte[32];\nnew SecureRandom().nextBytes(bytes);\nSecretKey key = new SecretKeySpec(bytes, \"AES\");\ntry {\n    Jwts.builder().encryptWith(key, ...).compact();\n} catch (JwtException e) {\n    logger.error(\"JCA failure: \" + e.getCause(), e);\n}","handlingStrategy":"try-catch","validationCode":"// validate key size before use\nif (key.getEncoded() != null && key.getEncoded().length < 32)\n    throw new InvalidKeyException(\"AES key must be at least 256 bits\");","typeGuard":null,"tryCatchPattern":"try {\n    return Jwts.parser().decryptWith(key).build().parseEncryptedClaims(token);\n} catch (JwtException e) {\n    log.error(\"JCA operation failed: {}\", e.getCause() != null ? e.getCause().getMessage() : e.getMessage(), e);\n    throw new AuthenticationException(e);\n}","preventionTips":["Always use keys of the exact required length (128/192/256-bit AES)","Always log the cause chain — the root JCA exception names the real problem","Use SecureRandom-generated keys from jjwt's builders","Verify provider configuration before deployment (FIPS/HSO environments)"],"tags":["jca","crypto","wrapped-exception","jwt"],"backgroundTag":"invalid-key-parameters","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}