{"record":{"id":"47a152dc80ab5e43","repo":"jwtk/jjwt","slug":"class-callback-execution-failed-t-getmessage","errorCode":null,"errorMessage":"${Class} callback execution failed: ${t.getMessage()}","messagePattern":"(.+?) callback execution failed: (.+?)","errorType":"exception","errorClass":"io.jsonwebtoken.security.SecurityException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JcaTemplate.java","lineNumber":123,"sourceCode":"\n    private <T, R> R execute(Class<T> clazz, CheckedFunction<T, R> callback, Provider provider) throws Exception {\n        InstanceFactory<?> factory = REGISTRY.get(clazz);\n        Assert.notNull(factory, \"Unsupported JCA instance class.\");\n\n        Object object = factory.get(this.jcaName, provider);\n        T instance = Assert.isInstanceOf(clazz, object, \"Factory instance does not match expected type.\");\n\n        return callback.apply(instance);\n    }\n\n    private <T> T execute(Class<?> clazz, CheckedSupplier<T> fn) throws SecurityException {\n        try {\n            return fn.get();\n        } catch (SecurityException se) {\n            throw se; //propagate\n        } catch (Throwable t) {\n            String msg = clazz.getSimpleName() + \" callback execution failed: \" + t.getMessage();\n            throw new SecurityException(msg, t);\n        }\n    }\n\n    private <T, R> R execute(final Class<T> clazz, final CheckedFunction<T, R> fn) throws SecurityException {\n        return execute(clazz, new CheckedSupplier<R>() {\n            @Override\n            public R get() throws Exception {\n                return execute(clazz, fn, JcaTemplate.this.provider);\n            }\n        });\n    }\n\n    protected <T, R> R fallback(final Class<T> clazz, final CheckedFunction<T, R> callback) throws SecurityException {\n        return execute(clazz, new CheckedSupplier<R>() {\n            @Override\n            public R get() throws Exception {\n                try {\n                    return execute(clazz, callback, JcaTemplate.this.provider);","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JcaTemplate.java#L105-L141","documentation":"JcaTemplate wraps JCE operations (Cipher, KeyFactory, SecretKeyFactory, KeyGenerator) in callback functions. Any Throwable thrown inside a callback other than SecurityException is wrapped into a SecurityException with this message naming the JCE class, preserving the cause. It signals that the underlying JCE call failed — e.g. bad algorithm parameters, unsupported provider, or invalid key material.","triggerScenarios":"Any jjwt crypto operation whose underlying JCE call fails: Cipher.doFinal/init throwing (invalid key spec, bad block sizes, AEADBadTagException), KeyFactory.generatePublic/Private with malformed key specs, SecretKeyFactory failures, or a required algorithm/provider missing so NoSuchAlgorithmException occurs.","commonSituations":"Missing JCE provider for an algorithm (e.g. no provider for a specific EC curve or AES-KW); key bytes that don't match the expected KeySpec; JDK restrictions or a typo'd algorithm; wrapping a JCE exception whose cause is the real problem.","solutions":["Inspect the exception's cause (`e.getCause()`) — it holds the original JCE error (NoSuchAlgorithmException, InvalidKeySpecException, AEADBadTagException, etc.).","Install/verify the required JCE provider (e.g. BouncyCastle) and register it before the operation.","Confirm the algorithm name and key type match what the callback requests.","Upgrade the JDK if the required algorithm is only available in newer versions."],"exampleFix":"// before: no BC provider registered\nJweParser p = Jwts.parser().decryptWith(key).build();\n// after\nSecurity.addProvider(new BouncyCastleProvider());\nJweParser p = Jwts.parser().decryptWith(key).build();","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  byte[] out = jcaTemplate.withCipher(cipherCallback);\n} catch (SecurityException e) {\n  Throwable jceCause = e.getCause(); // real JCE failure (NoSuchAlgorithmException, etc.)\n  logger.error(\"JCE operation failed\", jceCause);\n}","preventionTips":["Always inspect getCause() — the wrapped JCE exception is the actionable error","Register required providers (e.g. BouncyCastle) at startup","Pin a JDK that supports the algorithms you use","Test crypto paths early in CI on the target JDK"],"tags":["jce","crypto","provider","wrapped-exception"],"backgroundTag":"crypto-provider-failure","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}