{"record":{"id":"958667ae46436a2f","repo":"jwtk/jjwt","slug":"expected-expectedclaimname-claim-to-be-expecte","errorCode":null,"errorMessage":"Expected <expectedClaimName> claim to be: <expectedClaimValue>, but was: <actualClaimValue>.","messagePattern":"Expected <expectedClaimName> claim to be: <expectedClaimValue>, but was: <actualClaimValue>\\.","errorType":"exception","errorClass":"IncorrectClaimException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java","lineNumber":771,"sourceCode":"                } else {\n                    msg += \": \" + expectedClaimValue;\n                }\n                throw new MissingClaimException(header, claims, expectedClaimName, expectedClaimValue, msg);\n            } else if (expectedClaimValue instanceof Collection) {\n                Collection<?> expectedValues = (Collection<?>) expectedClaimValue;\n                Collection<?> actualValues = actualClaimValue instanceof Collection ? (Collection<?>) actualClaimValue :\n                        Collections.setOf(actualClaimValue);\n                for (Object expectedValue : expectedValues) {\n                    if (!Collections.contains(actualValues.iterator(), expectedValue)) {\n                        String msg = String.format(MISSING_EXPECTED_CLAIM_VALUE_MESSAGE_TEMPLATE,\n                                expectedValue, expectedClaimName, actualValues);\n                        throw new IncorrectClaimException(header, claims, expectedClaimName, expectedClaimValue, msg);\n                    }\n                }\n            } else if (!expectedClaimValue.equals(actualClaimValue)) {\n                String msg = String.format(INCORRECT_EXPECTED_CLAIM_MESSAGE_TEMPLATE,\n                        expectedClaimName, expectedClaimValue, actualClaimValue);\n                throw new IncorrectClaimException(header, claims, expectedClaimName, expectedClaimValue, msg);\n            }\n        }\n    }\n\n    @SuppressWarnings(\"deprecation\")\n    @Override\n    public <T> T parse(CharSequence compact, JwtHandler<T> handler) {\n        return parse(compact, Payload.EMPTY).accept(handler);\n    }\n\n    private Jwt<?, ?> parse(CharSequence compact, Payload unencodedPayload) {\n        Assert.hasText(compact, \"JWT String argument cannot be null or empty.\");\n        return parse(new CharSequenceReader(compact), unencodedPayload);\n    }\n\n    @Override\n    public Jwt<Header, byte[]> parseContentJwt(CharSequence jwt) {\n        return parse(jwt).accept(Jwt.UNSECURED_CONTENT);","sourceCodeStart":753,"sourceCodeEnd":789,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java#L753-L789","documentation":"Thrown as IncorrectClaimException when a required claim's value does not exactly equal the expected value passed to require(claimName, expectedValue) for a scalar (non-Collection, non-Date) expected value. This is the equality-failure branch of JJWT's claim requirement validation, after the missing-claim and collection-membership checks.","triggerScenarios":"parser.require(\"iss\", \"https://issuer.example.com\") or require(\"sub\", userId) where the claim is present but its value differs from the expected one (uses Object.equals).","commonSituations":"Wrong issuer URL or trailing-slash differences in 'iss'; token signed for a different subject/user; environment-specific issuer values (staging vs prod); case sensitivity mismatches ('APP' vs 'app').","solutions":["Verify the exact expected value against the token payload (decode the claims section) and fix require(...).","Fix the issuer to emit the expected claim value.","Normalize issuer/audience strings on both sides (trailing slashes, case) and re-deploy.","If multiple acceptable values exist, use require(name, collectionOfAcceptedValues) instead of a scalar."],"exampleFix":"// before\nJwts.parser().require(\"iss\", \"https://auth.example.com/\").verifyWith(key).build().parse(jwt); // token iss=\"https://auth.example.com\"\n// after\nJwts.parser().require(\"iss\", \"https://auth.example.com\").verifyWith(key).build().parse(jwt);","handlingStrategy":"validation","validationCode":"io.jsonwebtoken.Claims c = Jwts.parser().build().parseUnsecuredClaims(jwt).getPayload();\nif (!\"https://auth.example.com\".equals(c.get(\"iss\"))) {\n    throw new IllegalStateException(\"Unexpected iss: \" + c.get(\"iss\"));\n}","typeGuard":null,"tryCatchPattern":"try {\n    claims = Jwts.parser().requireIssuer(\"https://auth.example.com\").verifyWith(key)\n        .build().parseSignedClaims(jwt).getPayload();\n} catch (io.jsonwebtoken.IncorrectClaimException e) {\n    // reject: claim value mismatch; log e.getClaimName() and expected/actual\n}","preventionTips":["Normalize issuer URLs (no trailing slash, consistent scheme) on both sides","Use requireIssuer/requireSubject helpers rather than raw string equality in app code","Centralize expected claim values in configuration, not hardcoded literals","Test with tokens from every legitimate issuer variant"],"tags":["jwt","claims-validation","value-mismatch"],"backgroundTag":"jwt-claim-validation-failed","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}