{"record":{"id":"c85b25136aae80ae","repo":"jwtk/jjwt","slug":"unexpected-content-jwe","errorCode":null,"errorMessage":"Unexpected content JWE.","messagePattern":"Unexpected content JWE\\.","errorType":"exception","errorClass":"UnsupportedJwtException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java","lineNumber":184,"sourceCode":"            Assert.stateIsInstance(Claims.class, payload, \"Unexpected payload data type: \");\n            return onDecryptedClaims((Jwe<Claims>) jwe);\n        }\n    }\n\n    /**\n     * Handles an encountered JWE message that has been authenticated and decrypted, and has byte[] array payload. If\n     * the JWT creator has set the (optional) {@link Header#getContentType()} value, the application may inspect that\n     * value to determine how to convert the byte array to the final type as desired.\n     *\n     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that\n     * subclasses will override this method if the application needs to support this type of JWT.</p>\n     *\n     * @param jwe the parsed authenticated and decrypted content JWE.\n     * @return any object to be used after inspecting the JWS, or {@code null} if no return value is necessary.\n     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.\n     */\n    public T onDecryptedContent(Jwe<byte[]> jwe) {\n        throw new UnsupportedJwtException(\"Unexpected content JWE.\");\n    }\n\n    /**\n     * Handles an encountered JWE message that has been authenticated and decrypted, and has a {@link Claims} payload.\n     *\n     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that\n     * subclasses will override this method if the application needs to support this type of JWT.</p>\n     *\n     * @param jwe the parsed authenticated and decrypted content JWE.\n     * @return any object to be used after inspecting the JWE, or {@code null} if no return value is necessary.\n     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.\n     */\n    public T onDecryptedClaims(Jwe<Claims> jwe) {\n        throw new UnsupportedJwtException(\"Unexpected Claims JWE.\");\n    }\n}\n","sourceCodeStart":166,"sourceCodeEnd":201,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java#L166-L201","documentation":"SupportedJwtVisitor.onDecryptedContent is the default callback for a JWE (JSON Web Encryption) token that has been authenticated and decrypted, with an arbitrary (byte[]) content payload. The base class throws UnsupportedJwtException because it does not presume to know how to handle decrypted content; applications must override this method. Encountering it means an encrypted content JWE reached a visitor not configured for that type.","triggerScenarios":"Parsing an encrypted token (JWE, e.g. built with Jwts.builder().encryptWith(key, alg, enc) with non-Claims content) through a parser whose visitor does not override onDecryptedContent — after decryption succeeds, the visitor dispatch throws.","commonSituations":"Exchanging encrypted opaque payloads between systems; a producer switched from signed JWS to encrypted JWE while the consumer's visitor only handled JWS callbacks; generic decryption pipelines receiving content JWEs without a matching override.","solutions":["Override onDecryptedContent in your SupportedJwtVisitor subclass to handle Jwe<byte[]> and return the desired value.","If the payload should be Claims, build the JWE with claim-based APIs so onDecryptedClaims is dispatched instead.","Ensure the parser is configured with the correct decryption key so tokens dispatch to the intended callbacks.","If content JWEs are unexpected in this flow, reject the token and verify the sender's token type."],"exampleFix":"// before\nSupportedJwtVisitor<MyType> visitor = new SupportedJwtVisitor<>() {}; // throws on JWE\n// after\nSupportedJwtVisitor<MyType> visitor = new SupportedJwtVisitor<>() {\n    @Override\n    public MyType onDecryptedContent(Jwe<byte[]> jwe) {\n        return processDecrypted(jwe.getPayload());\n    }\n};","handlingStrategy":"try-catch","validationCode":"// Check the header for enc/alg indicating JWE before parsing\nString headerJson = new String(Base64.getUrlDecoder().decode(compact.split(\"\\\\.\")[0]));\nboolean isJwe = headerJson.contains(\"\\\"enc\\\"\");\nif (isJwe && !visitorSupportsJwe) {\n    throw new IllegalArgumentException(\"JWE tokens are not supported by this handler\");\n}","typeGuard":"boolean isJwe(String token) {\n    String[] p = token.split(\"\\\\.\", -1);\n    return p.length == 5 && new String(Base64.getUrlDecoder().decode(p[0])).contains(\"\\\"enc\\\"\");\n}","tryCatchPattern":"try {\n    result = Jwts.parser().decryptWith(key).build().parse(token);\n} catch (UnsupportedJwtException e) {\n    log.warn(\"Decrypted content JWE dispatched to a visitor without onDecryptedContent\", e);\n    throw new SecurityException(\"Content JWE not supported by this visitor\", e);\n}","preventionTips":["Override onDecryptedContent if any sender may encrypt raw payloads to you","Configure decryption keys and required algorithms explicitly on the parser","Filter or route JWE tokens by their 5-part compact shape before visitor dispatch","Keep producer/consumer token contracts documented (signed vs encrypted, claims vs content)"],"tags":["java","jwt","jjwt","jwe","unsupported-jwt"],"backgroundTag":"unsupported-operation","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}