{"record":{"id":"c957d38df9d26030","repo":"keycloak/keycloak","slug":"token-not-set","errorCode":null,"errorMessage":"Token not set","messagePattern":"Token not set","errorType":"exception","errorClass":"VerificationException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/keycloak/TokenVerifier.java","lineNumber":402,"sourceCode":"            audienceChecks[i] = new AudienceCheck(expectedAudiences[i]);\n        }\n        return this.replaceCheck(AudienceCheck.class, true, audienceChecks);\n    }\n\n    /**\n     * Add check for verifying that token issuedFor (azp claim) is the expected value\n     *\n     * @param expectedIssuedFor issuedFor, which needs to be in the target token. Can't be null\n     * @return This token verifier\n     */\n    public TokenVerifier<T> issuedFor(String expectedIssuedFor) {\n        return this.replaceCheck(IssuedForCheck.class, true, new IssuedForCheck(expectedIssuedFor));\n    }\n\n    public TokenVerifier<T> parse() throws VerificationException {\n        if (jws == null) {\n            if (tokenString == null) {\n                throw new VerificationException(\"Token not set\");\n            }\n\n            try {\n                jws = new JWSInput(tokenString);\n            } catch (JWSInputException e) {\n                throw new VerificationException(\"Failed to parse JWT\", e);\n            }\n\n\n            try {\n                token = jws.readJsonContent(clazz);\n            } catch (JWSInputException e) {\n                throw new VerificationException(\"Failed to read access token from JWT\", e);\n            }\n        }\n        return this;\n    }\n","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/keycloak/keycloak/blob/66c7e15a3788de7764f07dd2558275a02770e16d/core/src/main/java/org/keycloak/TokenVerifier.java#L384-L420","documentation":"Thrown by TokenVerifier.parse() when both the jws field and the tokenString field are null. parse() needs a token to deserialize; if no token string was supplied to the verifier (and no pre-parsed JWSInput), there is nothing to parse. This is a usage error — the verifier was constructed without a token and then asked to parse.","triggerScenarios":"Calling TokenVerifier.create(null, AccessToken.class) (or constructing a verifier and never setting a token) followed by .parse() or .verify(). The jws==null branch is entered and the inner tokenString==null check trips.","commonSituations":"A code path that extracts a token from a request header but proceeds even when the header is absent, or building a verifier lazily and forgetting to populate the token string.","solutions":["Ensure a non-null token string is supplied to TokenVerifier.create(token, clazz) before calling parse/verify.","Add a null/empty guard on the extracted Authorization header before constructing the verifier.","If the token is optional in your flow, branch before building the verifier rather than letting parse() throw."],"exampleFix":"// before: header may be null, verifier built unconditionally\nTokenVerifier.create(header, AccessToken.class).verify();\n\n// after: guard the token source\nif (header == null || header.isBlank()) {\n  throw new UnauthorizedException(\"Missing bearer token\");\n}\nTokenVerifier.create(header, AccessToken.class).verify();","handlingStrategy":"validation","validationCode":"// Guard the token source before constructing the verifier\nif (tokenString == null || tokenString.isBlank()) {\n  throw new UnauthorizedException(\"Missing bearer token\");\n}\nTokenVerifier.create(tokenString, AccessToken.class).verify();","typeGuard":"static boolean hasToken(String s) {\n  return s != null && !s.isBlank();\n}","tryCatchPattern":"try {\n  TokenVerifier.create(token, AccessToken.class).verify();\n} catch (VerificationException e) {\n  if (e.getMessage().equals(\"Token not set\")) {\n    // caller error — no token provided; return 401\n  } else throw e;\n}","preventionTips":["Always null/blank-check the Authorization header before building a verifier.","Construct the verifier only in the branch where a token is known to exist.","Return 401 early for missing tokens rather than relying on parse() to throw."],"tags":["jwt","verification","usage","null-input"],"backgroundTag":null,"analyzedSha":"66c7e15a3788de7764f07dd2558275a02770e16d","analyzedAt":"2026-08-14T01:36:42.651Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}