{"record":{"id":"8ae75d3a1c0b4d33","repo":"jwtk/jjwt","slug":"unsupported-signature-algorithm-alg-e-getm","errorCode":null,"errorMessage":"Unsupported signature algorithm '${alg}': ${e.getMessage()}","messagePattern":"Unsupported signature algorithm '(.+?)': (.+?)","errorType":"exception","errorClass":"SignatureException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java","lineNumber":280,"sourceCode":"        }\n    }\n\n    private static boolean hasContentType(Header header) {\n        return header != null && Strings.hasText(header.getContentType());\n    }\n\n    private byte[] verifySignature(final TokenizedJwt tokenized, final JwsHeader jwsHeader, final String alg,\n                                   @SuppressWarnings(\"deprecation\") SigningKeyResolver resolver, Claims claims, Payload payload) {\n\n        Assert.notNull(resolver, \"SigningKeyResolver instance cannot be null.\");\n\n        SecureDigestAlgorithm<?, Key> algorithm;\n        try {\n            algorithm = (SecureDigestAlgorithm<?, Key>) sigAlgs.apply(jwsHeader);\n        } catch (UnsupportedJwtException e) {\n            //For backwards compatibility.  TODO: remove this try/catch block for 1.0 and let UnsupportedJwtException propagate\n            String msg = \"Unsupported signature algorithm '\" + alg + \"': \" + e.getMessage();\n            throw new SignatureException(msg, e);\n        }\n        Assert.stateNotNull(algorithm, \"JWS Signature Algorithm cannot be null.\");\n\n        //digitally signed, let's assert the signature:\n        Key key;\n        if (claims != null) {\n            key = resolver.resolveSigningKey(jwsHeader, claims);\n        } else {\n            key = resolver.resolveSigningKey(jwsHeader, payload.getBytes());\n        }\n        if (key == null) {\n            String msg = \"Cannot verify JWS signature: unable to locate signature verification key for JWS with header: \" + jwsHeader;\n            throw new UnsupportedJwtException(msg);\n        }\n        Provider provider = ProviderKey.getProvider(key, this.provider); // extract if necessary\n        key = ProviderKey.getKey(key); // unwrap if necessary, MUST be called after ProviderKey.getProvider\n        Assert.stateNotNull(key, \"ProviderKey cannot be null.\"); //ProviderKey impl doesn't allow null\n        if (key instanceof PrivateKey) {","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java#L262-L298","documentation":"During parse(), verifySignature() resolves the JWS 'alg' header to a SecureDigestAlgorithm via the configured algorithm registry. If the header names an algorithm not registered/supported (or disabled by policy), the lookup throws UnsupportedJwtException, which is wrapped into a SignatureException with this message for backwards compatibility.","triggerScenarios":"Parsing a JWS whose 'alg' header names an algorithm not enabled in the parser (e.g. 'none' where signing required, or an algorithm removed/disabled via sig().add/remove, or a non-standard alg string like HS512 modified or typo'd).","commonSituations":"Token minted by another system using an algorithm your parser disabled; downgrade attempts; upgrading jjwt versions where legacy algorithms were excluded from defaults; attacker-supplied alg headers.","solutions":["Enable the needed algorithm in the parser via .sig().add(...) (or use Jwts.SIG defaults) or re-mint tokens with a supported algorithm","Check the 'alg' header of the failing token and ensure it matches what your verifyKey/verifyWith expects","If you intentionally reject the alg, catch SignatureException/UnsupportedJwtException and reject the token rather than enabling weak algorithms"],"exampleFix":"// before\nJws<Claims> jws = Jwts.parser().verifyWith(key).build().parseSignedClaims(token); // alg not in allowed set\n// after\nJws<Claims> jws = Jwts.parser()\n    .sig().add(Jwts.SIG.HS256).and()\n    .verifyWith(key)\n    .build()\n    .parseSignedClaims(token);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    return parser.parseSignedClaims(token);\n} catch (SignatureException e) {\n    if (e.getMessage().startsWith(\"Unsupported signature algorithm\")) {\n        log.warn(\"Token uses unregistered alg\");\n    }\n    throw new UnauthorizedException(e);\n}","preventionTips":["Explicitly register only the algorithms your issuer uses","Log the token's alg header on rejection to diagnose mismatches","Align algorithm policies across services that share tokens"],"tags":["jwt","signature","unsupported-algorithm"],"backgroundTag":"unsupported-enum-value","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}