{"record":{"id":"919e46b74673fbd4","repo":"jwtk/jjwt","slug":"payload-encoding-may-not-be-disabled-for-s-only-j","errorCode":null,"errorMessage":"Payload encoding may not be disabled for s, only JWSs.","messagePattern":"Payload encoding may not be disabled for s, only JWSs\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java","lineNumber":473,"sourceCode":"    @Override\n    public JwtBuilder issuedAt(Date iat) {\n        return claims().issuedAt(iat).and();\n    }\n\n    @Override\n    public JwtBuilder setId(String jti) {\n        return id(jti);\n    }\n\n    @Override\n    public JwtBuilder id(String jti) {\n        return claims().id(jti).and();\n    }\n\n    private void assertPayloadEncoding(String type) {\n        if (!this.encodePayload) {\n            String msg = \"Payload encoding may not be disabled for \" + type + \"s, only JWSs.\";\n            throw new IllegalArgumentException(msg);\n        }\n    }\n\n    @Override\n    public String compact() {\n\n        final boolean jwe = this.enc != null;\n\n        if (jwe && signFunction != null) {\n            String msg = \"Both 'signWith' and 'encryptWith' cannot be specified. Choose either one.\";\n            throw new IllegalStateException(msg);\n        }\n\n        Payload payload = Assert.stateNotNull(this.payload, \"Payload instance null, internal error\");\n        final Claims claims = this.claimsBuilder.build();\n\n        if (jwe && payload.isEmpty() && Collections.isEmpty(claims)) { // JWE payload can never be empty:\n            String msg = \"Encrypted JWTs must have either 'claims' or non-empty 'content'.\";","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java#L455-L491","documentation":"Disabling payload encoding (content() passthrough, encodePayload(false)) is only valid for JWSs. When building a JWE (encrypted) or unprotected JWT, an unencoded payload cannot be represented, so assertPayloadEncoding throws IllegalArgumentException.","triggerScenarios":"Calling builder.encodePayload(false) (direct unencoded content) together with encryptWith(...) or an unprotected JWT, then compact().","commonSituations":"Porting JWS compacting code that sets raw content to an encryption flow; toggling encodePayload off via config that also selects encryption.","solutions":["Remove the encodePayload(false) call when building encrypted or unprotected JWTs, and let the payload be encoded.","If unencoded payload is required, build a JWS instead of a JWE.","Gate the encodePayload(false) call behind the same condition that selects JWS output.","Catch IllegalArgumentException and report the invalid builder combination."],"exampleFix":"// before\nJwts.builder().content(payload).encodePayload(false).encryptWith(key, alg, enc).compact();\n// after\nJwts.builder().content(payload).encryptWith(key, alg, enc).compact(); // payload will be encoded","handlingStrategy":"validation","validationCode":"if (!encodePayload && (encrypting || unprotected)) throw new IllegalStateException(\"encodePayload(false) is JWS-only\");","typeGuard":null,"tryCatchPattern":"try { return builder.compact(); } catch (IllegalArgumentException e) { /* check encodePayload vs JWT type */ }","preventionTips":["Only call encodePayload(false) in JWS code paths","Keep raw-content JWS builders separate from JWE builders","Encode the toggle in config so it cannot combine with encryption"],"tags":["jwt","jwe","payload-encoding"],"backgroundTag":"conflicting-config-options","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}