{"record":{"id":"a008343f6919d0cd","repo":"jwtk/jjwt","slug":"unsupported-id-algtype-algorithm-is-disab","errorCode":null,"errorMessage":"Unsupported ${id} ${algType} algorithm... is disabled (no ${algType} algorithms have been configured).","messagePattern":"Unsupported (.+?) (.+?) algorithm\\.\\.\\. is disabled \\(no (.+?) algorithms have been configured\\)\\.","errorType":"exception","errorClass":"io.jsonwebtoken.UnsupportedJwtException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/IdLocator.java","lineNumber":76,"sourceCode":"\n        try {\n            return registry.forKey(id);\n        } catch (Exception e) {\n            StringBuilder sb = new StringBuilder(\"Unsupported \")\n                    .append(DefaultHeader.nameOf(header))\n                    .append(\" \")\n                    .append(this.param)\n                    .append(\" value '\").append(id).append(\"'\");\n            if (this.registry.isEmpty()) {\n                sb.append(\": \")\n                        .append(this.behavior)\n                        .append(\" is disabled (no \")\n                        .append(this.algType)\n                        .append(\" algorithms have been configured)\");\n            }\n            sb.append(\".\");\n            String msg = sb.toString();\n            throw new UnsupportedJwtException(msg, e);\n        }\n    }\n\n    @Override\n    public R apply(H header) {\n        return locate(header);\n    }\n}","sourceCodeStart":58,"sourceCodeEnd":84,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/IdLocator.java#L58-L84","documentation":"IdLocator resolved an algorithm identifier from the token (e.g. the alg header) but no algorithms of that type have been configured on the parser, so the algorithm is 'disabled'. It wraps the underlying lookup/verification failure in UnsupportedJwtException. This is a deliberate guard so tokens using algorithm families the application never enabled are rejected.","triggerScenarios":"Parsing a token whose alg header names an algorithm family (e.g. 'RS256' or 'dir') while the builder configured no algorithms of that algType (no verifyWith RSA keys, no key locators for that family, etc.).","commonSituations":"An issuer rotates from HMAC to RSA signing (or vice versa) but the consumer's parser only configures the old family; tightening security by whitelisting algorithms and receiving old tokens signed with now-disabled ones; asymmetric configuration between services.","solutions":["Configure the missing algorithm family on the parser (e.g. verifyWith the appropriate key type or extend the keyLocator registry)","Re-issue tokens using only the enabled algorithm families","If the algorithm should stay disabled, catch UnsupportedJwtException and reject the token explicitly"],"exampleFix":"// before\nJwtParser parser = Jwts.parser().verifyWith(hmacKey).build(); // token uses RS256\n// after\nJwtParser parser = Jwts.parser().verifyWith(rsaPublicKey).build();","handlingStrategy":"try-catch","validationCode":"String alg = parsed.getHeader(\"alg\");\nSet<String> enabled = Set.of(\"HS256\", \"RS256\");\nif (alg == null || !enabled.contains(alg)) throw new UnsupportedJwtException(\"alg not enabled: \" + alg);","typeGuard":null,"tryCatchPattern":"try {\n    Jws<Claims> jws = parser.parseClaimsJws(token);\n} catch (UnsupportedJwtException e) {\n    respond(401, \"Token algorithm is not accepted by this service\");\n}","preventionTips":["Keep the parser's configured algorithm families in sync with what the issuer signs","Explicitly whitelist algorithms and update the whitelist during key-rotation migrations","Reject unknown algorithms early with a clear 401 rather than a 500"],"tags":["jwt","unsupported-algorithm","parser-config"],"backgroundTag":"unsupported-operation","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}