{"record":{"id":"430647ee6e5b7f0c","repo":"quarkusio/quarkus","slug":"current-principal-principal-is-not-a-json-web-t","errorCode":null,"errorMessage":"Current principal ${principal} is not a JSON web token","messagePattern":"Current principal (.+?) is not a JSON web token","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/smallrye-jwt/runtime/src/main/java/io/quarkus/smallrye/jwt/runtime/auth/JwtPrincipalProducer.java","lineNumber":36,"sourceCode":"\n    @Inject\n    SecurityIdentity identity;\n\n    /**\n     * The producer method for the current JsonWebToken\n     *\n     * @return JsonWebToken\n     */\n    @Produces\n    @RequestScoped\n    JsonWebToken currentJWTPrincipalOrNull() {\n        if (identity.isAnonymous()) {\n            return new NullJsonWebToken();\n        }\n        if (identity.getPrincipal() instanceof JsonWebToken) {\n            return (JsonWebToken) identity.getPrincipal();\n        }\n        throw new IllegalStateException(\"Current principal \" + identity.getPrincipal() + \" is not a JSON web token\");\n    }\n}\n","sourceCodeStart":18,"sourceCodeEnd":39,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/smallrye-jwt/runtime/src/main/java/io/quarkus/smallrye/jwt/runtime/auth/JwtPrincipalProducer.java#L18-L39","documentation":"The JwtPrincipalProducer resolves the current security identity and returns its principal as a JsonWebToken; anonymous identities get a NullJsonWebToken sentinel. If the identity is authenticated but its principal is not a JsonWebToken (i.e. the request was authenticated by a mechanism other than SmallRye JWT), the producer throws this IllegalStateException when JsonWebToken is produced into the application.","triggerScenarios":"Injecting JsonWebToken (or calling this producer) in a request authenticated by Basic auth, form auth, OIDC bearer token authentication, or any non-smallrye-jwt mechanism — identity.getPrincipal() is then not a JWT.","commonSituations":"Mixed authentication setups where some endpoints use quarkus-oidc bearer auth and code also injects JsonWebToken; Basic-auth protected management endpoints with JWT-injecting beans; testing with TestSecurity using a non-JWT principal; JWT auth disabled by misconfiguration while code assumes it.","solutions":["Ensure the request is actually authenticated via quarkus-smallrye-jwt (mp.jwt.verify.* / quarkus.smallrye-jwt config) so the principal is a JsonWebToken","If OIDC is the real mechanism, consume the OIDC identity instead of JsonWebToken","Guard the injection point: inject SecurityIdentity and check getPrincipal() instanceof JsonWebToken before use","Fix test security setup to provide a JWT principal when testing JWT paths"],"exampleFix":"// before\n@Inject JsonWebToken jwt; // fails for non-JWT auth mechanisms\n\n// after\n@Inject SecurityIdentity identity;\n\nString upn() {\n    if (identity.getPrincipal() instanceof JsonWebToken jwt) {\n        return jwt.getSubject();\n    }\n    return identity.getPrincipal().getName();\n}","handlingStrategy":"type-guard","validationCode":"@Inject SecurityIdentity identity;\n\nJsonWebToken jwtOrNull() {\n    return identity.getPrincipal() instanceof JsonWebToken jwt ? jwt : null;\n}","typeGuard":"static boolean isJwtPrincipal(SecurityIdentity identity) {\n    return !identity.isAnonymous() && identity.getPrincipal() instanceof JsonWebToken;\n}","tryCatchPattern":"try {\n    JsonWebToken jwt = jwtPrincipalProducer.currentJWTPrincipalOrNull();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"is not a JSON web token\")) {\n        log.warn(\"Request not authenticated via JWT; falling back to generic principal\");\n        return identity.getPrincipal().getName();\n    }\n    throw e;\n}","preventionTips":["Inject SecurityIdentity and narrow with instanceof instead of injecting JsonWebToken directly in mixed-auth apps","Keep smallrye-jwt auth the sole mechanism for endpoints that inject JsonWebToken","Align TestSecurity setups with the production auth mechanism","Document per-endpoint auth mechanisms next to JWT injection points"],"tags":["jwt","security","authentication","runtime","quarkus"],"backgroundTag":"principal-not-a-jwt","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}