{"record":{"id":"3723021a15b615e4","repo":"spring-projects/spring-security","slug":"failed-to-select-the-jwk-s-ex-getmessage","errorCode":null,"errorMessage":"Failed to select the JWK(s) -> ${ex.getMessage()}","messagePattern":"Failed to select the JWK\\(s\\) -> (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":500,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/NimbusJwkSetEndpointFilter.java","lineNumber":98,"sourceCode":"\t\tthis.jwkSelector = new JWKSelector(new JWKMatcher.Builder().build());\n\t\tthis.requestMatcher = PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.GET, jwkSetEndpointUri);\n\t}\n\n\t@Override\n\tprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)\n\t\t\tthrows ServletException, IOException {\n\n\t\tif (!this.requestMatcher.matches(request)) {\n\t\t\tfilterChain.doFilter(request, response);\n\t\t\treturn;\n\t\t}\n\n\t\tJWKSet jwkSet;\n\t\ttry {\n\t\t\tjwkSet = new JWKSet(this.jwkSource.get(this.jwkSelector, null));\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new IllegalStateException(\"Failed to select the JWK(s) -> \" + ex.getMessage(), ex);\n\t\t}\n\n\t\tresponse.setContentType(MediaType.APPLICATION_JSON_VALUE);\n\t\ttry (Writer writer = response.getWriter()) {\n\t\t\twriter.write(jwkSet.toString()); // toString() excludes private keys\n\t\t}\n\t}\n\n}\n","sourceCodeStart":80,"sourceCodeEnd":108,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/NimbusJwkSetEndpointFilter.java#L80-L108","documentation":"This IllegalStateException from NimbusJwkSetEndpointFilter.doFilterInternal is thrown when the JWKSource fails to select JWKs for the JWK Set endpoint request. The original exception message is appended so the underlying key-loading failure is visible. Without a JWK Set, clients cannot discover the server's public keys.","triggerScenarios":"A GET to the JWK Set endpoint (default /oauth2/jwks) while JWKSource.get() throws — e.g. key store unavailable, decryption failure, or selector matching failure.","commonSituations":"Keystore/PEM file missing or unreadable at runtime; wrong keystore password; keys not loaded at startup; misconfigured JWKSet bean after rotation.","solutions":["Read the wrapped message to find why JWKSource.get() failed","Verify the key store/PEM file exists, is readable, and the password is correct","Ensure JWKSource is properly initialized with at least one key before serving requests","Re-test the /oauth2/jwks endpoint after fixing key loading"],"exampleFix":"// before: missing keystore at runtime\nJWKSource<SecurityContext> jwkSource = new JWKSetSource(new File(\"/wrong/path/keystore.p12\"));\n// after: verify and fail fast at startup\nif (!Files.exists(Path.of(\"/etc/certs/keystore.p12\"))) {\n    throw new IllegalStateException(\"Keystore missing\");\n}\nJWKSource<SecurityContext> jwkSource = loadJwks(\"/etc/certs/keystore.p12\");","handlingStrategy":"validation","validationCode":"// Fail fast at startup if keys cannot be loaded\nList<JWK> keys = jwkSource.get(new JWKSelector(new JWKMatcher.Builder().build()), null);\nif (keys == null || keys.isEmpty()) throw new IllegalStateException(\"No JWKs loaded\");","typeGuard":"boolean hasLoadableJwks(JWKSource<SecurityContext> src) {\n    try { return !src.get(new JWKSelector(new JWKMatcher.Builder().build()), null).isEmpty(); }\n    catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n    mockMvc.perform(get(\"/oauth2/jwks\"));\n} catch (IllegalStateException e) {\n    if (e.getMessage().startsWith(\"Failed to select the JWK(s)\")) {\n        logger.error(\"JWK source failure: {}\", e.getCause());\n    }\n}","preventionTips":["Verify keystore/PEM paths and passwords in the deployment environment before start","Load and validate the JWK set eagerly at application startup","Test the /oauth2/jwks endpoint as part of health checks"],"tags":["jwks","keys","oauth2","spring-security"],"backgroundTag":"resource-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}