{"record":{"id":"c2fadbd7e50c1279","repo":"jwtk/jjwt","slug":"the-none-algorithm-cannot-be-used-to-create-sign","errorCode":null,"errorMessage":"The 'none' algorithm cannot be used to create signatures.","messagePattern":"The 'none' algorithm cannot be used to create signatures\\.","errorType":"exception","errorClass":"SignatureException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/NoneSignatureAlgorithm.java","lineNumber":43,"sourceCode":"import java.security.Key;\n\nfinal class NoneSignatureAlgorithm implements SecureDigestAlgorithm<Key, Key> {\n\n    private static final String ID = \"none\";\n\n    static final SecureDigestAlgorithm<Key, Key> INSTANCE = new NoneSignatureAlgorithm();\n\n    private NoneSignatureAlgorithm() {\n    }\n\n    @Override\n    public String getId() {\n        return ID;\n    }\n\n    @Override\n    public byte[] digest(SecureRequest<InputStream, Key> request) throws SecurityException {\n        throw new SignatureException(\"The 'none' algorithm cannot be used to create signatures.\");\n    }\n\n    @Override\n    public boolean verify(VerifySecureDigestRequest<Key> request) throws SignatureException {\n        throw new SignatureException(\"The 'none' algorithm cannot be used to verify signatures.\");\n    }\n\n    @Override\n    public boolean equals(Object obj) {\n        return this == obj ||\n                (obj instanceof SecureDigestAlgorithm &&\n                        ID.equalsIgnoreCase(((SecureDigestAlgorithm<?, ?>) obj).getId()));\n    }\n\n    @Override\n    public int hashCode() {\n        return getId().hashCode();\n    }","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/NoneSignatureAlgorithm.java#L25-L61","documentation":"The 'none' algorithm is a placeholder JWS algorithm that, per RFC 7518, performs no cryptographic operations. The JJWT library deliberately refuses to create signatures with it, throwing SignatureException from digest(), because unsigned JWTs are insecure and the 'none' algorithm is only useful for verification of explicitly unsecured tokens.","triggerScenarios":"Calling Jwls.builder().signWith(Jwts.SIG.none) or otherwise configuring 'alg: none' when trying to SIGN (serialize) a JWS; also calling NoneSignatureAlgorithm.digest() directly.","commonSituations":"Developers porting from other JWT libraries where 'none' was allowed for signing, or intentionally trying to produce an unsecured JWT (which JJWT does not support for signing).","solutions":["Pick a real signing algorithm such as Jwts.SIG.HS256 with a SecretKey, or RS256/ES256 with a key pair.","If an unsecured token is truly needed, construct it manually or use a library that permits 'none' signing, understanding the security implications.","Wrap jwt building/signing in try-catch for SignatureException to surface a clearer error to callers."],"exampleFix":"// before\nJwtBuilder b = Jwts.builder().subject(\"me\").signWith(Jwts.SIG.none);\n// after\nJwtBuilder b = Jwts.builder().subject(\"me\")\n    .signWith(Jwts.SIG.HS256, secretKey);","handlingStrategy":"validation","validationCode":"if (alg != null && \"none\".equals(alg.getId())) {\n    throw new IllegalArgumentException(\"Signing with 'none' is not allowed\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    String jwt = Jwts.builder().signWith(alg, key)...compact();\n} catch (SignatureException e) {\n    // alg=none or signing failure: surface config error\n}","preventionTips":["Never configure 'none' for signing","Always use a concrete algorithm + strong key","Review algorithm selection in security audits"],"tags":["jwt","security","signature"],"backgroundTag":"unsupported-operation","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}