{"record":{"id":"9168981967e408b1","repo":"apereo/cas","slug":"could-not-determine-the-hash-algorithm-for-token","errorCode":null,"errorMessage":"Could not determine the hash algorithm for token","messagePattern":"Could not determine the hash algorithm for token","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/response/accesstoken/OAuth20TokenHashGenerator.java","lineNumber":73,"sourceCode":"        if (AlgorithmIdentifiers.HMAC_SHA512.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.RSA_USING_SHA512.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.RSA_PSS_USING_SHA512.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.ECDSA_USING_P521_CURVE_AND_SHA512.equalsIgnoreCase(algorithm)) {\n            return MessageDigestAlgorithms.SHA_512;\n        }\n        if (AlgorithmIdentifiers.HMAC_SHA384.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.RSA_USING_SHA384.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.RSA_PSS_USING_SHA384.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.ECDSA_USING_P384_CURVE_AND_SHA384.equalsIgnoreCase(algorithm)) {\n            return MessageDigestAlgorithms.SHA_384;\n        }\n        if (AlgorithmIdentifiers.HMAC_SHA256.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.RSA_USING_SHA256.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.RSA_PSS_USING_SHA256.equalsIgnoreCase(algorithm)\n            || AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256.equalsIgnoreCase(algorithm)) {\n            return MessageDigestAlgorithms.SHA_256;\n        }\n        throw new IllegalArgumentException(\"Could not determine the hash algorithm for token\");\n    }\n}\n","sourceCodeStart":55,"sourceCodeEnd":76,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/response/accesstoken/OAuth20TokenHashGenerator.java#L55-L76","documentation":"Thrown as IllegalArgumentException by the token-hash generator when the JWS algorithm identifier of the access token does not map to any supported message-digest (hash) algorithm. Only SHA-256-family combinations (HMAC/RSA/RSA-PSS/ECDSA P-256 with SHA256) are currently recognized, so at-token hashing (e.g. for token binding in introspection or id_token claims) cannot proceed.","triggerScenarios":"Generating an at_hash/token hash for an access token signed with an algorithm other than the supported SHA-256 set — e.g. HS384/HS512, RS384/RS512, ES384/ES512/EdDSA tokens reaching the hash generator.","commonSituations":"Configuring the access-token JWT builder with a stronger algorithm (RS512, ES512) while some downstream component still calls the hash generator that only supports SHA-256; version upgrades where token signing algorithm was changed but hashing path was not updated.","solutions":["Configure the access token signing algorithm to a supported SHA-256 variant (HS256, RS256, PS256, or ES256)","If you need stronger algorithms, extend the mapping in determineSigningHashAlgorithm to add SHA-384/SHA-512 cases and corresponding digests","Check cas.authn.oauth.accessToken.jwt* settings for an algorithm override that introduced the unsupported alg","Verify no upstream proxy re-signs tokens with a different algorithm before hashing"],"exampleFix":"// before\ncas.authn.oauth.access-token.jwt-alg=RS512\n// after\ncas.authn.oauth.access-token.jwt-alg=RS256","handlingStrategy":"validation","validationCode":"const SUPPORTED = ['HS256','RS256','PS256','ES256'];\nif (!SUPPORTED.includes(signingAlg)) throw new Error(`algorithm ${signingAlg} cannot be hashed by OAuth20TokenHashGenerator; use a SHA-256 family algorithm`);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep access-token signing algorithms within the SHA-256 family (HS256/RS256/PS256/ES256)","Review algorithm overrides in cas.authn.oauth access-token JWT settings after upgrades","If stronger algorithms are required, extend the hash mapping in the generator first"],"tags":["oauth2","jwt","hash","algorithm"],"backgroundTag":"unsupported-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}