{"record":{"id":"529c421f5f98c93d","repo":"jwtk/jjwt","slug":"the-none-jws-algorithm-cannot-be-used-to-sign-jw","errorCode":null,"errorMessage":"The 'none' JWS algorithm cannot be used to sign JWTs.","messagePattern":"The 'none' JWS algorithm cannot be used to sign JWTs\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java","lineNumber":237,"sourceCode":"        // Implementation note:  Ordinarily Passwords should not be used to create secure digests because they usually\n        // lack the length or entropy necessary for secure cryptographic operations, and are prone to misuse.\n        // However, we DO NOT prevent them as arguments here (like the above PublicKey check) because\n        // it is conceivable that a custom SecureDigestAlgorithm implementation would allow Password instances\n        // so that it might perform its own internal key-derivation logic producing a key that is then used to create a\n        // secure hash.\n        //\n        // Even so, a fallback safety check is that JJWT's only out-of-the-box Password implementation\n        // (io.jsonwebtoken.impl.security.PasswordSpec) explicitly forbids calls to password.getEncoded() in all\n        // scenarios to avoid potential misuse, so a digest algorithm implementation would explicitly need to avoid\n        // this by calling toCharArray() instead.\n        //\n        // TLDR; the digest algorithm implementation has the final say whether a password instance is valid\n\n        Assert.notNull(alg, \"SignatureAlgorithm cannot be null.\");\n        String id = Assert.hasText(alg.getId(), \"SignatureAlgorithm id cannot be null or empty.\");\n        if (Jwts.SIG.NONE.getId().equalsIgnoreCase(id)) {\n            String msg = \"The 'none' JWS algorithm cannot be used to sign JWTs.\";\n            throw new IllegalArgumentException(msg);\n        }\n        this.key = key;\n        //noinspection unchecked\n        this.sigAlg = (SecureDigestAlgorithm<Key, ?>) alg;\n        this.signFunction = Functions.wrap(request -> sigAlg.digest(request), SignatureException.class, \"Unable to compute %s signature.\", id);\n        return this;\n    }\n\n    @SuppressWarnings({\"deprecation\", \"unchecked\"}) // TODO: remove method for 1.0\n    @Override\n    public JwtBuilder signWith(Key key, io.jsonwebtoken.SignatureAlgorithm alg) throws InvalidKeyException {\n        Assert.notNull(alg, \"SignatureAlgorithm cannot be null.\");\n        alg.assertValidSigningKey(key); //since 0.10.0 for https://github.com/jwtk/jjwt/issues/334\n        return signWith(key, (SecureDigestAlgorithm<? super Key, ?>) Jwts.SIG.get().forKey(alg.getValue()));\n    }\n\n    @SuppressWarnings(\"deprecation\") // TODO: remove method for 1.0\n    @Override","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java#L219-L255","documentation":"The 'none' algorithm means an unsigned JWT and is not permitted as a signing algorithm; calling signWith with it would silently produce an unsecured token while appearing to 'sign' it, so the builder throws IllegalArgumentException.","triggerScenarios":"JwtBuilder.signWith(key, Jwts.SIG.NONE) (or a SignatureAlgorithm resolving to id 'none').","commonSituations":"Refactored code after migrating from the deprecated SignatureAlgorithm enum; misconfigured algorithm names coming from properties/env config set to 'none'; code paths that skip signing conditionally but still call signWith.","solutions":["Choose a real algorithm, e.g. signWith(key, Jwts.SIG.HS256) or RS256/ES256 as appropriate for your key type.","If an unsigned token is genuinely intended, use Jwts.builder().unprotected() (or omit signing) instead of signWith with 'none'.","Validate any externally supplied algorithm name against your allow-list before passing it to signWith.","Catch IllegalArgumentException and reject the configuration at startup."],"exampleFix":"// before\nbuilder.signWith(key, Jwts.SIG.NONE);\n// after\nbuilder.signWith(key, Jwts.SIG.HS256);","handlingStrategy":"validation","validationCode":"if (Jwts.SIG.NONE.getId().equalsIgnoreCase(alg.getId())) throw new IllegalArgumentException(\"'none' cannot sign\");","typeGuard":null,"tryCatchPattern":"try { builder.signWith(key, alg); } catch (IllegalArgumentException e) { /* reject 'none' config */ }","preventionTips":["Never source algorithm names from untrusted config without an allow-list","Use Jwts.builder().unprotected() explicitly when an unsigned token is intended","Migrate away from the deprecated SignatureAlgorithm enum carefully, checking NONE mappings"],"tags":["jwt","signing","none-algorithm"],"backgroundTag":"invalid-enum-value","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}