{"record":{"id":"e21a140e62c44d76","repo":"jwtk/jjwt","slug":"unsecureddecompression-is-only-relevant-if-unse","errorCode":null,"errorMessage":"'unsecuredDecompression' is only relevant if 'unsecured' is also configured. Please read the JavaDoc of both features before enabling either due to their security implications.","messagePattern":"'unsecuredDecompression' is only relevant if 'unsecured' is also configured\\. Please read the JavaDoc of both features before enabling either due to their security implications\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.java","lineNumber":398,"sourceCode":"                throw new IllegalStateException(msg);\n            }\n            if (this.decryptionKey != null) {\n                String msg = \"Both 'keyLocator' and a 'decryptWith' key cannot be configured. \" +\n                        \"Prefer 'keyLocator' if possible.\";\n                throw new IllegalStateException(msg);\n            }\n        }\n\n        Locator<? extends Key> keyLocator = this.keyLocator; // user configured default, don't overwrite to ensure further build() calls work as expected\n        if (keyLocator == null) {\n            keyLocator = new ConstantKeyLocator(this.signatureVerificationKey, this.decryptionKey);\n        }\n\n        if (!unsecured && unsecuredDecompression) {\n            String msg = \"'unsecuredDecompression' is only relevant if 'unsecured' is also \" +\n                    \"configured. Please read the JavaDoc of both features before enabling either \" +\n                    \"due to their security implications.\";\n            throw new IllegalStateException(msg);\n        }\n        if (this.compressionCodecResolver != null && !Jwts.ZIP.get().equals(this.zipAlgs)) {\n            String msg = \"Both 'zip()' and 'compressionCodecResolver' \" +\n                    \"cannot be configured. Choose either.\";\n            throw new IllegalStateException(msg);\n        }\n\n        // Invariants.  If these are ever violated, it's an error in this class implementation:\n        Assert.stateNotNull(keyLocator, \"Key locator should never be null.\");\n\n        final DefaultClaims expClaims = (DefaultClaims) this.expectedClaims.build();\n\n        return new DefaultJwtParser(\n                provider,\n                signingKeyResolver,\n                unsecured,\n                unsecuredDecompression,\n                keyLocator,","sourceCodeStart":380,"sourceCodeEnd":416,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.java#L380-L416","documentation":"The 'unsecuredDecompression' parser feature (allowing decompression of unsecured/JWS payload parts) only has meaning when 'unsecured' tokens are also accepted. Enabling it alone is treated as a misconfiguration, so build() throws IllegalStateException with a warning to read the JavaDoc of both features because they carry security implications (decompression bombs, accepting unsigned tokens).","triggerScenarios":"Calling .enableUnsecuredDecompression() (or equivalent) without calling .enableUnsecured() on DefaultJwtParserBuilder before build().","commonSituations":"Copy-pasting hardening/compatibility snippets from documentation or Stack Overflow that enable decompression for unsecured tokens; turning on decompression support to fix a parsing failure without realizing it requires the 'unsecured' flag too.","solutions":["Add .enableUnsecured() alongside the unsecuredDecompression flag if you truly need to accept unsecured tokens","Remove the unsecuredDecompression call if you never accept unsecured (unsigned) JWTs — this is the safest fix","Read the JavaDoc of both features and confirm the security trade-offs before enabling either"],"exampleFix":"// before\nJwtParser parser = Jwts.parser()\n    .enableUnsecuredDecompression()\n    .build();\n// after\nJwtParser parser = Jwts.parser()\n    .enableUnsecured()\n    .enableUnsecuredDecompression()\n    .build();","handlingStrategy":"validation","validationCode":"boolean unsecured = false; boolean unsecuredDecompression = true;\nif (unsecuredDecompression && !unsecured) {\n    throw new IllegalArgumentException(\"unsecuredDecompression requires enableUnsecured()\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    JwtParser p = builder.build();\n} catch (IllegalStateException e) {\n    log.error(\"Inconsistent parser feature flags: {}\", e.getMessage());\n}","preventionTips":["Never enable unsecured features unless legacy unsigned tokens must be accepted","Read the JavaDoc security notes before enabling decompression features","Keep feature-flag toggles paired in configuration code"],"tags":["jwt","parser-config","compression","security"],"backgroundTag":"invalid-config-value","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}