{"record":{"id":"749caa8b6875af6a","repo":"jwtk/jjwt","slug":"compact-jwt-strings-may-not-contain-whitespace","errorCode":null,"errorMessage":"Compact JWT strings may not contain whitespace.","messagePattern":"Compact JWT strings may not contain whitespace\\.","errorType":"validation","errorClass":"io.jsonwebtoken.MalformedJwtException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/JwtTokenizer.java","lineNumber":67,"sourceCode":"        CharSequence encryptedKey = Strings.EMPTY; //JWE only\n        CharSequence iv = Strings.EMPTY; //JWE only\n        CharSequence digest = Strings.EMPTY; //JWS Signature or JWE AAD Tag\n\n        int delimiterCount = 0;\n        char[] buf = new char[4096];\n        int len = 0;\n        StringBuilder sb = new StringBuilder(4096);\n        while (len != Streams.EOF) {\n\n            len = read(reader, buf);\n\n            for (int i = 0; i < len; i++) {\n\n                char c = buf[i];\n\n                if (Character.isWhitespace(c)) {\n                    String msg = \"Compact JWT strings may not contain whitespace.\";\n                    throw new MalformedJwtException(msg);\n                }\n\n                if (c == DELIMITER) {\n\n                    CharSequence seq = Strings.clean(sb);\n                    String token = seq != null ? seq.toString() : Strings.EMPTY;\n\n                    switch (delimiterCount) {\n                        case 0:\n                            protectedHeader = token;\n                            break;\n                        case 1:\n                            body = token; //for JWS\n                            encryptedKey = token; //for JWE\n                            break;\n                        case 2:\n                            body = Strings.EMPTY; //clear out value set for JWS\n                            iv = token;","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/JwtTokenizer.java#L49-L85","documentation":"Compact JWT serialization (header.payload.signature or 5-part JWE) must be a single whitespace-free string. JwtTokenizer scans every character while tokenizing and throws MalformedJwtException if any whitespace character is present, since whitespace would make the compact form ambiguous and non-standard.","triggerScenarios":"Calling parse/parseClaimsJws with a token String containing spaces, newlines, or tabs — typically from copy-paste, log output wrapping, base64 line breaks, or reading a token from a file/database with trailing '\\n'.","commonSituations":"Tokens pasted from emails/docs/PDFs with line wraps; tokens read from files or environment variables without trimming; tokens embedded in HTML/log text and extracted with surrounding whitespace.","solutions":["Trim the token before parsing: token.trim() and also remove internal whitespace if the source wrapped lines","Extract the token from a single canonical source (Authorization header bearer value, cookie) rather than free text","Catch MalformedJwtException and return a 400-level 'malformed token' response"],"exampleFix":"// before\nString token = configFileLine; // \"eyJ...\\n.eyJ...\"\nJwts.parser().verifyWith(key).parseClaimsJws(token);\n// after\nString token = configFileLine.replaceAll(\"\\\\s\", \"\");\nJwts.parser().verifyWith(key).parseClaimsJws(token);","handlingStrategy":"validation","validationCode":"if (token == null || !token.trim().equals(token) || token.chars().anyMatch(Character::isWhitespace)) {\n    throw new MalformedJwtException(\"JWT contains whitespace\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Jws<Claims> jws = parser.parseClaimsJws(token.trim());\n} catch (MalformedJwtException e) {\n    respond(400, \"Malformed token\");\n}","preventionTips":["Always trim tokens read from files, env vars, or user input","Extract tokens from structured sources (Authorization header) not pasted text","Strip line wraps when copying tokens out of logs or documents"],"tags":["jwt","malformed-token","whitespace"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}