{"record":{"id":"437c0c66ca752c08","repo":"lcobucci/jwt","slug":"the-token-is-not-identified-with-the-expected-id","errorCode":null,"errorMessage":"The token is not identified with the expected ID","messagePattern":"The token is not identified with the expected ID","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/IdentifiedBy.php","lineNumber":20,"sourceCode":"declare(strict_types=1);\n\nnamespace Lcobucci\\JWT\\Validation\\Constraint;\n\nuse Lcobucci\\JWT\\Token;\nuse Lcobucci\\JWT\\Validation\\Constraint;\nuse Lcobucci\\JWT\\Validation\\ConstraintViolation;\n\nfinal readonly class IdentifiedBy implements Constraint\n{\n    /** @param non-empty-string $id */\n    public function __construct(private string $id)\n    {\n    }\n\n    public function assert(Token $token): void\n    {\n        if (! $token->isIdentifiedBy($this->id)) {\n            throw ConstraintViolation::error(\n                'The token is not identified with the expected ID',\n                $this,\n            );\n        }\n    }\n}\n","sourceCodeStart":2,"sourceCodeEnd":27,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/IdentifiedBy.php#L2-L27","documentation":"This ConstraintViolation is thrown by the IdentifiedBy validation constraint of lcobucci/jwt. It fires when the token's `jti` (JWT ID) claim does not equal the ID configured in the constraint, or when the token has no `jti` at all. The constraint exists to let applications reject tokens that are not the specific token instance they expect (e.g. for single-use or revocation checks).","triggerScenarios":"Calling IdentifiedByConstraint::assert($token) where Token::isIdentifiedBy($this->id) returns false — i.e. the token lacks a `jti` claim, or its `jti` claim value differs from the id passed to the constraint's constructor.","commonSituations":"Verifying a token against IdentifiedBy::constraint('some-id') when the token was minted without a `jti` claim (the builder was not told ->identifiedBy(...)); comparing against an ID from a database record that was regenerated; typos or case mismatches in the expected ID; reusing a validation configuration copied from another token.","solutions":["Ensure the token is created with ->identifiedBy('expected-id') in the builder so the `jti` claim is present and matches.","Check the exact ID string passed to the IdentifiedBy constraint and compare it (case-sensitively) with the token's `jti` claim.","If the token legitimately has no `jti`, remove the IdentifiedBy constraint from the validator configuration.","Log/inspect the received token's `jti` (e.g. $token->claims()->get('jti')) to see what is actually being compared."],"exampleFix":"// before: token built without jti\n$token = $config->builder()->withClaim('sub', 'user1')->getToken($config->signer(), $config->signingKey());\n$validator->assert($token, $constraints); // throws\n\n// after: build the token with the expected ID\n$token = $config->builder()\n    ->identifiedBy('expected-id')\n    ->withClaim('sub', 'user1')\n    ->getToken($config->signer(), $config->signingKey());","handlingStrategy":"try-catch","validationCode":"$jti = $token->claims()->get('jti');\nif ($jti === null || $jti !== $expectedId) {\n    // reject before calling the constraint\n}","typeGuard":"function hasExpectedId(Lcobucci\\JWT\\Token $token, string $expectedId): bool\n{\n    $jti = $token->claims()->get('jti');\n    return is_string($jti) && $jti === $expectedId;\n}","tryCatchPattern":"try {\n    $validator->assert($token, $constraints);\n} catch (Lcobucci\\JWT\\Validation\\ConstraintViolation $e) {\n    if ($e->getConstraint() instanceof Lcobucci\\JWT\\Validation\\Constraint\\IdentifiedBy) {\n        // token id mismatch: treat as unauthorized\n    }\n}","preventionTips":["Always mint tokens with ->identifiedBy() when using the IdentifiedBy constraint.","Store the expected jti in a constant/config, not inline literals.","Log the actual jti on failure to ease debugging.","Unit-test your validation pipeline with both matching and non-matching tokens."],"tags":["jwt","validation-constraint","jti-claim"],"backgroundTag":"schema-validation-failed","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}