{"record":{"id":"c208648285230271","repo":"alibaba/nacos","slug":"unsupported-signature-algorithm","errorCode":null,"errorMessage":"unsupported signature algorithm","messagePattern":"unsupported signature algorithm","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java","lineNumber":111,"sourceCode":"     * @param key for signature\n     * @return object for payload\n     * @throws AccessException access exception\n     */\n    public static NacosUser verify(String jwt, Key key) throws AccessException {\n        if (StringUtils.isBlank(jwt)) {\n            throw new AccessException(\"user not found!\");\n        }\n        String[] split = jwt.split(\"\\\\.\");\n        if (split.length != JWT_PARTS) {\n            throw new AccessException(\"token invalid!\");\n        }\n        String header = split[HEADER_POSITION];\n        String payload = split[PAYLOAD_POSITION];\n        String signature = split[SIGNATURE_POSITION];\n        \n        NacosSignatureAlgorithm signatureAlgorithm = MAP.get(header);\n        if (signatureAlgorithm == null) {\n            throw new AccessException(\"unsupported signature algorithm\");\n        }\n        NacosUser user = signatureAlgorithm.verify(header, payload, signature, key);\n        user.setToken(jwt);\n        return user;\n    }\n    \n    /**\n     * verify jwt.\n     *\n     * @param header    header of jwt\n     * @param payload   payload of jwt\n     * @param signature signature of jwt\n     * @param key       for signature\n     * @return object for payload\n     * @throws AccessException access exception\n     */\n    public NacosUser verify(String header, String payload, String signature, Key key)\n        throws AccessException {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java#L93-L129","documentation":"Thrown by NacosSignatureAlgorithm.verify() as an AccessException when the JWT header does not match any registered Nacos signature algorithm. Nacos only recognizes HS256, HS384, and HS512 (looked up by their pre-encoded base64url header constants); any other algorithm header (e.g., RS256, none, or an unrecognized HS variant) is rejected.","triggerScenarios":"MAP.get(header) returns null because the token's base64url-encoded header does not equal the HS256/HS384/HS512 header constant; e.g., an RS256-signed token or a token with extra header fields that change the base64 encoding.","commonSituations":"A third-party IdP issued an RS256/RS512 token that the client presents to Nacos; the token header includes custom claims that alter its encoding; mixing tokens from a different JWT library.","solutions":["Use a token issued by Nacos itself (signed with the configured HS secret key).","If federating via OIDC, exchange/mint a locally-signed HS token rather than passing the IdP token directly.","Confirm the token alg is HS256/HS384/HS512 (decode the header at jwt.io to inspect)."],"exampleFix":"// before: client presents an RS256 IdP token\nAuthorization: Bearer <rs256-idp-token> // -> unsupported signature algorithm\n\n// after: exchange for a Nacos-issued HS256 token\nAuthorization: Bearer <nacos-accessToken>","handlingStrategy":"validation","validationCode":"String[] parts = jwt.split(\"\\\\.\");\nString headerJson = new String(Base64.getUrlDecoder().decode(parts[0]), StandardCharsets.UTF_8);\nString alg = JacksonUtils.toObj(headerJson, Map.class).get(\"alg\").toString();\nif (!Set.of(\"HS256\", \"HS384\", \"HS512\").contains(alg)) {\n    throw new AccessException(\"unsupported signature algorithm: \" + alg);\n}","typeGuard":null,"tryCatchPattern":"try {\n    NacosSignatureAlgorithm.verify(jwt, key);\n} catch (AccessException e) {\n    if (\"unsupported signature algorithm\".equals(e.getMessage())) {\n        // exchange external IdP token for a Nacos HS token\n    }\n    throw e;\n}","preventionTips":["Only present HS256/HS384/HS512 tokens to Nacos verify().","For federated auth, mint a local HS token rather than passing an RS token.","Decode the token header during debugging to confirm the alg."],"tags":["auth","jwt","algorithm","security"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}