{"record":{"id":"2c2b83f4d2019a1b","repo":"lcobucci/jwt","slug":"the-token-is-not-related-to-the-expected-subject","errorCode":null,"errorMessage":"The token is not related to the expected subject","messagePattern":"The token is not related to the expected subject","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/RelatedTo.php","lineNumber":20,"sourceCode":"declare(strict_types=1);\n\nnamespace Lcobucci\\JWT\\Validation\\Constraint;\n\nuse Lcobucci\\JWT\\Token;\nuse Lcobucci\\JWT\\Validation\\Constraint;\nuse Lcobucci\\JWT\\Validation\\ConstraintViolation;\n\nfinal readonly class RelatedTo implements Constraint\n{\n    /** @param non-empty-string $subject */\n    public function __construct(private string $subject)\n    {\n    }\n\n    public function assert(Token $token): void\n    {\n        if (! $token->isRelatedTo($this->subject)) {\n            throw ConstraintViolation::error(\n                'The token is not related to the expected subject',\n                $this,\n            );\n        }\n    }\n}\n","sourceCodeStart":2,"sourceCodeEnd":27,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/RelatedTo.php#L2-L27","documentation":"Thrown by the RelatedTo constraint when the token's sub (subject) claim does not equal the subject configured in the constraint. It fires during assert() when Token::isRelatedTo() returns false, meaning the token is not associated with the expected subject (e.g. the authenticated user or resource owner).","triggerScenarios":"Thrown at src/Validation/Constraint/RelatedTo.php:20 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the RelatedTo constraint with the subject identifier that matches the token's sub claim (e.g. the current user's ID)","If you are the issuer, ensure the sub claim is populated with the intended subject when minting the token","Verify the token belongs to the requester before acting on it; otherwise reject it as potentially misused"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}