{"record":{"id":"452d9e71dfdb9f52","repo":"quarkusio/quarkus","slug":"jwk-is-not-available-neither-kid-nor-x5t-s256","errorCode":null,"errorMessage":"JWK is not available, neither 'kid' nor 'x5t#S256' nor 'x5t' token headers are set","messagePattern":"JWK is not available, neither 'kid' nor 'x5t#S256' nor 'x5t' token headers are set","errorType":"exception","errorClass":"org.jose4j.keys.resolvers.UnresolvableKeyException","httpStatus":401,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java","lineNumber":604,"sourceCode":"                } catch (InvalidAlgorithmException ex) {\n                    LOG.debug(\"Token 'alg'(algorithm) header value is invalid\", ex);\n                }\n            }\n\n            if (key == null && oidcConfig.jwks().tryAll() && kid == null && thumbprint == null) {\n                LOG.debug(\"JWK is not available, neither 'kid' nor 'x5t#S256' nor 'x5t' token headers are set,\"\n                        + \" falling back to trying all available keys\");\n                key = jwks.findKeyInAllKeys(jws);\n            }\n\n            if (key == null && chainResolverFallback != null) {\n                LOG.debug(\"JWK is not available, neither 'kid' nor 'x5t#S256' nor 'x5t' token headers are set,\"\n                        + \" falling back to the certificate chain resolver\");\n                key = chainResolverFallback.resolveKey(jws, nestingContext);\n            }\n\n            if (key == null) {\n                throw new UnresolvableKeyException(\n                        \"JWK is not available, neither 'kid' nor 'x5t#S256' nor 'x5t' token headers are set\");\n            } else {\n                return key;\n            }\n        }\n\n        private Key getKeyWithId(String kid) {\n            if (kid != null) {\n                return jwks.getKeyWithId(kid);\n            } else {\n                LOG.debug(\"Token 'kid' header is not set\");\n                return null;\n            }\n        }\n\n        private Key getKeyWithThumbprint(String thumbprint) {\n            if (thumbprint != null) {\n                return jwks.getKeyWithThumbprint(thumbprint);","sourceCodeStart":586,"sourceCodeEnd":622,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java#L586-L622","documentation":"Thrown by OidcProvider's JsonWebKeyResolver.resolveKey when a token has none of 'kid', 'x5t#S256', or 'x5t' headers and the fallback certificate-chain resolver (chainResolverFallback) also fails to produce a key. There is no header information to select a JWK with, so verification cannot proceed and UnresolvableKeyException is thrown.","triggerScenarios":"Verifying a JWT with a bare JOSE header (no kid/thumbprints) whose signature also cannot be matched by trying all keys via the certificate chain fallback.","commonSituations":"Token issuer omits 'kid' entirely (common with hand-rolled signers or some JWT libraries) and JWKS contains multiple keys so 'try all' is ambiguous or the cert chain is absent; tokens not actually issued by the configured provider; encrypted-nested tokens where the inner header lacks key hints.","solutions":["Have the token issuer include a 'kid' header matching a JWKS entry — the standard fix","Pin the signing key locally with quarkus.oidc.token.public-key so resolution doesn't depend on headers","Check the token originates from the configured tenant at all","If the provider publishes exactly one key, ensure JWKS fetching succeeds (network, TLS, jwks-path config)"],"exampleFix":"// before: unsigned-header token fails\n// after (issuer side):\nJWSSigner signer = new RSASSASigner(privateKey);\nJWSObject jws = new JWSObject(header.withKeyID(\"key-1\"), payload); // add kid\n// or app side: quarkus.oidc.token.public-key=...","handlingStrategy":"validation","validationCode":"// require a kid header before sending the token for verification\nvar header = decodeJwtHeader(token);\nif (header.get(\"kid\") == null && header.get(\"x5t#S256\") == null && header.get(\"x5t\") == null) {\n    throw new IllegalStateException(\"Token has no key-identifying header; cannot verify via JWKS\");\n}","typeGuard":"boolean hasKeyHint(JsonObject header) {\n    return header.containsKey(\"kid\") || header.containsKey(\"x5t#S256\") || header.containsKey(\"x5t\");\n}","tryCatchPattern":null,"preventionTips":["Require token issuers to set a 'kid' header","Configure a local public key to avoid header-dependent resolution","Verify tokens only from issuers you control the signing configuration of"],"tags":["jwt","oidc","jwks","key-resolution"],"backgroundTag":"jwk-kid-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}