{"record":{"id":"68889818c7e8db89","repo":"passbolt/passbolt_api","slug":"the-0-configuration-value-should-be-a-string-or-null","errorCode":null,"errorMessage":"The {0} configuration value should be a string or NULL.","messagePattern":"The (.+?) configuration value should be a string or NULL\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php","lineNumber":312,"sourceCode":"    /**\n     * Returns the alg of the keys.\n     *\n     * @return mixed\n     */\n    protected function getJwksDefaultAlg(): mixed\n    {\n        return Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg');\n    }\n\n    /**\n     * @param mixed $defaultAlg Value to assert.\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException When configuration value is invalid.\n     */\n    private function assertJwkDefaultAlg(mixed $defaultAlg): void\n    {\n        if (!is_null($defaultAlg) && !is_string($defaultAlg)) {\n            throw new InternalErrorException(__(\n                'The {0} configuration value should be a string or NULL.',\n                'passbolt.plugins.sso.security.jwks.defaultAlg'\n            ));\n        }\n\n        /**\n         * \"alg\" (Algorithm) Header Parameter Values for JWS.\n         *\n         * @link https://datatracker.ietf.org/doc/html/rfc7518#section-3\n         */\n        $allowedAlgValues = ['HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES384', 'ES256'];\n        if (is_string($defaultAlg) && !in_array($defaultAlg, $allowedAlgValues)) {\n            throw new InternalErrorException(__(\n                'The {0} configuration value should be one of the following: {1}.',\n                'passbolt.plugins.sso.security.jwks.defaultAlg',\n                implode(', ', $allowedAlgValues)\n            ));\n        }","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php#L294-L330","documentation":"assertJwkDefaultAlg() validates the passbolt.plugins.sso.security.jwks.defaultAlg configuration used when a JWK omits its 'alg' parameter. Only string values or NULL are acceptable; any other type (int, bool, array) makes getJwtVerificationKeys() abort with this InternalErrorException.","triggerScenarios":"The config key passbolt.plugins.sso.security.jwks.defaultAlg is set to a non-string, non-null value — e.g. an integer, boolean, or array in config/passbolt.php or via a wrongly-typed environment substitution.","commonSituations":"Typo in config where a boolean or number is used as the algorithm; dynamic env parsing converting a value to a non-string; copy-pasted config from another setup with wrong types.","solutions":["Set passbolt.plugins.sso.security.jwks.defaultAlg to a string such as 'RS256' or remove it entirely (NULL) in config/passbolt.php","Dump Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg') with var_dump to check the actual type","Fix env-based config so values are strings, e.g. use (string)getenv(...) or quote the value","Run ./bin/cake passbolt healthcheck after changing the config to confirm it validates"],"exampleFix":"// before\n'jwks' => ['defaultAlg' => 256],\n// after\n'jwks' => ['defaultAlg' => 'RS256'],","handlingStrategy":"validation","validationCode":"$defaultAlg = Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg');\nif (!is_null($defaultAlg) && !is_string($defaultAlg)) {\n    throw new \\InvalidArgumentException('defaultAlg must be a string or null');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only assign string literals (e.g. 'RS256') or omit the key entirely in config/passbolt.php","Avoid untyped env substitutions for this config value","Run healthcheck after config changes","Document the expected type in your deployment config templates"],"tags":["config","jwks","sso","type-error"],"backgroundTag":"config-type-mismatch","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}