{"record":{"id":"2dcc95f8be404071","repo":"jwtk/jjwt","slug":"malformed-name-json-t-getmessage","errorCode":null,"errorMessage":"Malformed ${name} JSON: ${t.getMessage()}","messagePattern":"Malformed (.+?) JSON: (.+?)","errorType":"validation","errorClass":"io.jsonwebtoken.MalformedJwtException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/io/JsonObjectDeserializer.java","lineNumber":76,"sourceCode":"                String msg = \"Deserialized data is not a JSON Object; cannot create Map<String,?>\";\n                throw new DeserializationException(msg);\n            }\n            // JSON Specification requires all JSON Objects to have string-only keys.  So instead of\n            // checking that the val.keySet() has all Strings, we blindly cast to a Map<String,?>\n            // since input would rarely, if ever, have non-string keys.\n            //noinspection unchecked\n            return (Map<String, ?>) value;\n        } catch (StackOverflowError e) {\n            String msg = String.format(MALFORMED_COMPLEX_ERROR, this.name, this.name, e.getMessage());\n            throw new DeserializationException(msg, e);\n        } catch (Throwable t) {\n            throw malformed(t);\n        }\n    }\n\n    protected RuntimeException malformed(Throwable t) {\n        String msg = String.format(MALFORMED_ERROR, this.name, t.getMessage());\n        throw new MalformedJwtException(msg, t);\n    }\n}\n","sourceCodeStart":58,"sourceCodeEnd":79,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/io/JsonObjectDeserializer.java#L58-L79","documentation":"Thrown as a MalformedJwtException when deserializing the named JSON fails for any reason other than a null/non-object result or a StackOverflowError — typically syntactically invalid JSON. The message identifies which named part (e.g. 'header', 'payload') was malformed and includes the parser's cause message.","triggerScenarios":"Calling apply/deserialize on JsonObjectDeserializer with content the underlying JSON parser cannot parse: truncated JSON, invalid tokens, wrong encoding, or non-UTF-8 bytes.","commonSituations":"Hand-truncated JWTs; tokens altered in transit (URL encoding/decoding damage); tokens signed over a payload that was later modified; passing the full compact JWS string where only a segment was expected.","solutions":["Inspect t.getMessage() in the cause to see the exact parser error and character position.","Verify the token was not truncated or URL-encoded/decoded incorrectly in transit.","Ensure you are decoding the correct base64url segment (payload for claims, header for header).","Use JJWT's parse APIs with the correct key; mismatched keys can lead to garbage after failed MAC verification paths.","Re-obtain the token from the source if corruption is suspected."],"exampleFix":"// before\nString part = token.split(\"\\\\.\")[1].replace(\"-\", \"+\").replace(\"_\", \"/\"); // ad-hoc decode can corrupt\n// after\nbyte[] json = io.jsonwebtoken.io.Decoders.BASE64URL.decode(part);\nString jsonStr = new String(json, StandardCharsets.UTF_8); // verify valid JSON before parsing","handlingStrategy":"try-catch","validationCode":"// Java\nString[] parts = token.split(\"\\\\.\");\nif (parts.length < 2) throw new IllegalArgumentException(\"not a compact JWT\");\nbyte[] payload = Decoders.BASE64URL.decode(parts[1]);\nString json = new String(payload, StandardCharsets.UTF_8);\nif (!json.trim().startsWith(\"{\")) throw new IllegalArgumentException(\"payload is not JSON\");","typeGuard":"static boolean looksLikeJwt(String token) {\n    if (token == null) return false;\n    String[] parts = token.split(\"\\\\.\");\n    return parts.length == 3 || parts.length == 5;\n}","tryCatchPattern":"try {\n    Jws<Claims> jws = Jwts.parser().verifyWith(key).build().parseClaimsJws(token);\n} catch (MalformedJwtException e) {\n    log.warn(\"Malformed JWT rejected: {}\", e.getMessage());\n    throw new BadRequestException(\"Invalid token format\");\n}","preventionTips":["Validate the compact JWS structure (3 or 5 dot-separated base64url segments) before parsing.","Avoid ad-hoc base64 conversions that corrupt token bytes; use Decoders.BASE64URL.","Reject tokens that arrived URL-encoded or HTML-escaped.","Never modify token strings after receiving them; log the exact raw value when debugging."],"tags":["json","jwt","malformed","deserialization"],"backgroundTag":"json-parse-error","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}