{"record":{"id":"b69a325aad7af0c1","repo":"jwtk/jjwt","slug":"both-signwith-and-encryptwith-cannot-be-specif","errorCode":null,"errorMessage":"Both 'signWith' and 'encryptWith' cannot be specified. Choose either one.","messagePattern":"Both 'signWith' and 'encryptWith' cannot be specified\\. Choose either one\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java","lineNumber":484,"sourceCode":"    public JwtBuilder id(String jti) {\n        return claims().id(jti).and();\n    }\n\n    private void assertPayloadEncoding(String type) {\n        if (!this.encodePayload) {\n            String msg = \"Payload encoding may not be disabled for \" + type + \"s, only JWSs.\";\n            throw new IllegalArgumentException(msg);\n        }\n    }\n\n    @Override\n    public String compact() {\n\n        final boolean jwe = this.enc != null;\n\n        if (jwe && signFunction != null) {\n            String msg = \"Both 'signWith' and 'encryptWith' cannot be specified. Choose either one.\";\n            throw new IllegalStateException(msg);\n        }\n\n        Payload payload = Assert.stateNotNull(this.payload, \"Payload instance null, internal error\");\n        final Claims claims = this.claimsBuilder.build();\n\n        if (jwe && payload.isEmpty() && Collections.isEmpty(claims)) { // JWE payload can never be empty:\n            String msg = \"Encrypted JWTs must have either 'claims' or non-empty 'content'.\";\n            throw new IllegalStateException(msg);\n        } // otherwise JWS and Unprotected JWT payloads can be empty\n\n        if (!payload.isEmpty() && !Collections.isEmpty(claims)) {\n            throw new IllegalStateException(\"Both 'content' and 'claims' cannot be specified. Choose either one.\");\n        }\n\n        if (this.serializer == null) { // try to find one based on the services available\n            //noinspection unchecked\n            json(Services.get(Serializer.class));\n        }","sourceCodeStart":466,"sourceCodeEnd":502,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtBuilder.java#L466-L502","documentation":"A compact JWT is either signed (JWS) or encrypted (JWE), never both simultaneously. Specifying both signWith and encryptWith on the same builder is ambiguous, so compact() throws IllegalStateException.","triggerScenarios":"Calling builder.signWith(...) and later builder.encryptWith(...) on the same builder instance, then compact(). Common with shared/configured builders where both security settings are applied.","commonSituations":"Nested/nested-JWT attempts done by chaining both calls instead of the documented nested JWT pattern; a builder configured by multiple code paths each assuming the other mode.","solutions":["Choose one protection mode: remove signWith for encrypted tokens or remove encryptWith for signed ones.","For sign-then-encrypt (nested JWT), build the inner signed JWS string first, then encrypt that string with a second builder: Jwts.builder().content(innerJws).encryptWith(...).compact().","Refactor so a single code path/config decides signing vs encryption per builder.","Catch IllegalStateException and report the mutually exclusive configuration."],"exampleFix":"// before\nJwts.builder().setClaims(c).signWith(key).encryptWith(pubKey, alg, enc).compact();\n// after\nString jws = Jwts.builder().setClaims(c).signWith(key).compact();\nString jwe = Jwts.builder().content(jws).encryptWith(pubKey, alg, enc).compact();","handlingStrategy":"validation","validationCode":"if (signingConfigured && encryptingConfigured) throw new IllegalStateException(\"Choose either signWith or encryptWith\");","typeGuard":null,"tryCatchPattern":"try { return builder.compact(); } catch (IllegalStateException e) { /* builder has both sign and encrypt set */ }","preventionTips":["One builder, one protection mode","For nested JWTs, chain two builders (sign inner, encrypt outer)","Centralize token creation so signing and encryption are mutually exclusive config branches"],"tags":["jwt","jws","jwe","builder"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}