{"record":{"id":"b77bebf09183203b","repo":"lcobucci/jwt","slug":"token-signer-mismatch","errorCode":null,"errorMessage":"Token signer mismatch","messagePattern":"Token signer mismatch","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/SignedWith.php","lineNumber":25,"sourceCode":"use Lcobucci\\JWT\\Token;\nuse Lcobucci\\JWT\\UnencryptedToken;\nuse Lcobucci\\JWT\\Validation\\ConstraintViolation;\nuse Lcobucci\\JWT\\Validation\\SignedWith as SignedWithInterface;\n\nfinal readonly class SignedWith implements SignedWithInterface\n{\n    public function __construct(private Signer $signer, private Signer\\Key $key)\n    {\n    }\n\n    public function assert(Token $token): void\n    {\n        if (! $token instanceof UnencryptedToken) {\n            throw ConstraintViolation::error('You should pass a plain token', $this);\n        }\n\n        if ($token->headers()->get('alg') !== $this->signer->algorithmId()) {\n            throw ConstraintViolation::error('Token signer mismatch', $this);\n        }\n\n        if (! $this->signer->verify($token->signature()->hash(), $token->payload(), $this->key)) {\n            throw ConstraintViolation::error('Token signature mismatch', $this);\n        }\n    }\n}\n","sourceCodeStart":7,"sourceCodeEnd":33,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/SignedWith.php#L7-L33","documentation":"Thrown by SignedWith::assert() when the token header's alg value differs from the algorithm of the configured signer. The constraint verifies the signature with a specific Signer/Key pair, so a token signed with any other algorithm (e.g. an HS256 token checked against an RS256 signer) fails this check before signature verification even runs.","triggerScenarios":"Thrown at src/Validation/Constraint/SignedWith.php:25 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the SignedWith constraint with the same signer algorithm (and key) that the token issuer used to sign the token","If you are the issuer, ensure the alg header matches the algorithm actually used for signing","Reject tokens with unexpected algorithms rather than accepting multiple algorithms implicitly; pin the expected signer explicitly"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}