{"record":{"id":"8c58fd73e737bc3c","repo":"jwtk/jjwt","slug":"encrypted-jwts-must-have-either-claims-or-non-em","errorCode":null,"errorMessage":"Encrypted JWTs must have either 'claims' or non-empty 'content'.","messagePattern":"Encrypted JWTs must have either 'claims' or non-empty 'content'\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java","lineNumber":492,"sourceCode":"        }\n    }\n\n    @Override\n    public String compact() {\n\n        final boolean jwe = this.enc != null;\n\n        if (jwe && signFunction != null) {\n            String msg = \"Both 'signWith' and 'encryptWith' cannot be specified. Choose either one.\";\n            throw new IllegalStateException(msg);\n        }\n\n        Payload payload = Assert.stateNotNull(this.payload, \"Payload instance null, internal error\");\n        final Claims claims = this.claimsBuilder.build();\n\n        if (jwe && payload.isEmpty() && Collections.isEmpty(claims)) { // JWE payload can never be empty:\n            String msg = \"Encrypted JWTs must have either 'claims' or non-empty 'content'.\";\n            throw new IllegalStateException(msg);\n        } // otherwise JWS and Unprotected JWT payloads can be empty\n\n        if (!payload.isEmpty() && !Collections.isEmpty(claims)) {\n            throw new IllegalStateException(\"Both 'content' and 'claims' cannot be specified. Choose either one.\");\n        }\n\n        if (this.serializer == null) { // try to find one based on the services available\n            //noinspection unchecked\n            json(Services.get(Serializer.class));\n        }\n\n        if (!Collections.isEmpty(claims)) { // normalize so we have one object to deal with:\n            payload = new Payload(claims);\n        }\n        if (compressionAlgorithm != null && !payload.isEmpty()) {\n            payload.setZip(compressionAlgorithm);\n            this.headerBuilder.put(DefaultHeader.COMPRESSION_ALGORITHM.getId(), compressionAlgorithm.getId());\n        }","sourceCodeStart":474,"sourceCodeEnd":510,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java#L474-L510","documentation":"A JWE's payload is always encoded and protected, but it must contain something: when building an encrypted JWT the builder requires either claims or non-empty content. If both are absent, compact() throws IllegalStateException because an empty encrypted payload is meaningless and not representable.","triggerScenarios":"Calling compact() after encryptWith(...) without calling claims(...)/setClaims(...) or content(...) with non-empty data.","commonSituations":"Builders reused across requests where the payload-setting branch was skipped; conditional logic that only sets claims sometimes; refactors that dropped the claims call while keeping encryptWith.","solutions":["Set claims: Jwts.builder().claims().subject(...).and().encryptWith(...) before compact().","Or set non-empty content: builder.content(byte[]/String payload).","Add an assertion before compact(): ensure the builder has claims or content when encryption is configured.","Catch IllegalStateException and treat it as a programming/configuration bug in the token-building path."],"exampleFix":"// before\nJwts.builder().encryptWith(pubKey, alg, enc).compact(); // empty\n// after\nJwts.builder().claims().subject(\"user\").and().encryptWith(pubKey, alg, enc).compact();","handlingStrategy":"validation","validationCode":"if (encrypting && claims == null && (content == null || content.length == 0)) throw new IllegalStateException(\"JWE needs claims or non-empty content\");","typeGuard":null,"tryCatchPattern":"try { return builder.compact(); } catch (IllegalStateException e) { /* JWE built without payload */ }","preventionTips":["Always set claims or content before compact() when using encryptWith","Never reuse builder instances across requests without resetting payload state","Add unit tests asserting compact() output is non-empty for encrypted tokens"],"tags":["jwt","jwe","empty-payload"],"backgroundTag":"empty-required-field","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}