{"record":{"id":"8eb6161e7e48ca4d","repo":"jwtk/jjwt","slug":"jwk-set-keys-value-cannot-be-null","errorCode":null,"errorMessage":"JWK Set keys value cannot be null.","messagePattern":"JWK Set keys value cannot be null\\.","errorType":"validation","errorClass":"io.jsonwebtoken.security.MalformedKeySetException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JwkSetConverter.java","lineNumber":92,"sourceCode":"        if (o instanceof JwkSet) {\n            return (JwkSet) o;\n        }\n        if (!(o instanceof Map)) {\n            String msg = \"Value must be a Map<String,?> (JSON Object). Type found: \" + o.getClass().getName() + \".\";\n            throw new IllegalArgumentException(msg);\n        }\n        final Map<?, ?> m = Collections.immutable((Map<?, ?>) o);\n\n        // mandatory for all JWK Sets: https://datatracker.ietf.org/doc/html/rfc7517#section-5\n        // no need for builder parameter type conversion overhead if this isn't present:\n        if (Collections.isEmpty(m) || !m.containsKey(PARAM.getId())) {\n            String msg = \"Missing required \" + PARAM + \" parameter.\";\n            throw new MalformedKeySetException(msg);\n        }\n        Object val = m.get(PARAM.getId());\n        if (val == null) {\n            String msg = \"JWK Set \" + PARAM + \" value cannot be null.\";\n            throw new MalformedKeySetException(msg);\n        }\n        if (!(val instanceof Collection)) {\n            String msg = \"JWK Set \" + PARAM + \" value must be a Collection (JSON Array). Type found: \" +\n                    val.getClass().getName();\n            throw new MalformedKeySetException(msg);\n        }\n        int size = Collections.size((Collection<?>) val);\n        if (size == 0) {\n            String msg = \"JWK Set \" + PARAM + \" collection cannot be empty.\";\n            throw new MalformedKeySetException(msg);\n        }\n\n        // Copy values so we don't mutate the original input\n        Map<String, Object> src = new LinkedHashMap<>(Collections.size((Map<?, ?>) o));\n        for (Map.Entry<?, ?> entry : ((Map<?, ?>) o).entrySet()) {\n            Object key = Assert.notNull(entry.getKey(), \"JWK Set map key cannot be null.\");\n            if (!(key instanceof String)) {\n                String msg = \"JWK Set map keys must be Strings. Encountered key '\" + key + \"' of type \" +","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JwkSetConverter.java#L74-L110","documentation":"Thrown by JwkSetConverter.applyFrom when the JWK Set's keys member exists but its value is null. RFC 7517 §5 requires keys to hold the array of JWKs, so a null value is treated as a malformed JWK Set and rejected with MalformedKeySetException.","triggerScenarios":"Parsing a JWKS map like {\"keys\": null} or programmatically building the set with a null keys value.","commonSituations":"Template/serialization output emitting explicit nulls; upstream JWKS endpoint returning keys:null when it has no keys; placeholder config.","solutions":["Provide a non-null JSON array for \"keys\", e.g. [] with at least one JWK","Check the upstream JWKS source for why keys is null","Sanitize input to reject/replace null-valued fields before parsing"],"exampleFix":"// before\n{\"keys\": null}\n// after\n{\"keys\":[{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"...\",\"y\":\"...\"}]}","handlingStrategy":"validation","validationCode":"Object keys = m.get(\"keys\"); if (keys == null) { throw new IllegalArgumentException(\"JWKS 'keys' must not be null\"); }","typeGuard":"boolean hasNonNullKeys(Map<?,?> m) { return m != null && m.get(\"keys\") != null; }","tryCatchPattern":"try { jwkSet = jwkSetConverter.applyFrom(map); } catch (MalformedKeySetException e) { log.error(\"JWKS keys null: {}\", e.getMessage()); }","preventionTips":["Treat upstream keys:null as an upstream provisioning failure","Sanitize null-valued members before parsing"],"tags":["jwt","jwks","null","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}