{"record":{"id":"c857fa072ebad4da","repo":"lcobucci/jwt","slug":"encryption-is-not-supported-yet","errorCode":null,"errorMessage":"Encryption is not supported yet","messagePattern":"Encryption is not supported yet","errorType":"exception","errorClass":"Lcobucci\\JWT\\Token\\UnsupportedHeaderFound","httpStatus":null,"severity":"error","filePath":"src/Token/Parser.php","lineNumber":92,"sourceCode":"     * @param non-empty-string $data\n     *\n     * @return array<non-empty-string, mixed>\n     *\n     * @throws UnsupportedHeaderFound When an invalid header is informed.\n     * @throws InvalidTokenStructure  When parsed content isn't an array.\n     */\n    private function parseHeader(string $data): array\n    {\n        $header = $this->decoder->jsonDecode($this->decoder->base64UrlDecode($data));\n\n        if (! is_array($header)) {\n            throw InvalidTokenStructure::arrayExpected('headers');\n        }\n\n        $this->guardAgainstEmptyStringKeys($header, 'headers');\n\n        if (array_key_exists('enc', $header)) {\n            throw UnsupportedHeaderFound::encryption();\n        }\n\n        if (! array_key_exists('typ', $header)) {\n            $header['typ'] = 'JWT';\n        }\n\n        return $header;\n    }\n\n    /**\n     * Parses the claim set from a string\n     *\n     * @param non-empty-string $data\n     *\n     * @return array<non-empty-string, mixed>\n     *\n     * @throws InvalidTokenStructure When parsed content isn't an array or contains non-parseable dates.\n     */","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Token/Parser.php#L74-L110","documentation":"Parser::parseHeader() rejects JWE-style headers: if the decoded header contains the 'enc' (content encryption algorithm) claim, UnsupportedHeaderFound::encryption() is thrown because this library does not support encrypted JWTs (JWE), only signed JWS tokens.","triggerScenarios":"Parsing a JWE compact serialization (5 segments) or a token whose header includes an 'enc' member, e.g. {\"alg\":\"RSA-OAEP\",\"enc\":\"A256GCM\"}.","commonSituations":"Receiving encrypted ID tokens from an OIDC provider with JWE enabled; mixing up JWS and JWE tokens; configuring the identity provider to encrypt (not just sign) tokens.","solutions":["Disable token encryption at the identity provider / configure it to emit signed (JWS) tokens instead of JWE","Use a library that supports JWE (e.g. web-token/jwt-framework) if you must handle encrypted tokens","Check the token has 3 segments (JWS), not 5 (JWE), before parsing","Catch UnsupportedHeaderFound and return a clear 'encrypted tokens not supported' error"],"exampleFix":"// before\n$token = $parser->parse($jwt); // jwt is a 5-part JWE\n// after\nif (substr_count($jwt, '.') !== 2) {\n    throw new InvalidArgumentException('Encrypted JWTs (JWE) are not supported; use web-token/jwt-framework');\n}\n$token = $parser->parse($jwt);","handlingStrategy":"try-catch","validationCode":"if (substr_count($jwt, '.') === 5) { throw new InvalidArgumentException('JWE detected; not supported'); }","typeGuard":null,"tryCatchPattern":"try { $token = $parser->parse($jwt); } catch (Lcobucci\\JWT\\UnsupportedHeaderFound $e) { return error_401('Encrypted tokens are not supported'); }","preventionTips":["Configure identity providers to issue signed JWS, not encrypted JWE","Adopt web-token/jwt-framework if JWE support is required","Check segment count (3 = JWS, 5 = JWE) as an early routing check"],"tags":["jwt","jwe","encryption","unsupported"],"backgroundTag":"unsupported-operation","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}