{"record":{"id":"e9cd7d56e83a29ad","repo":"jwtk/jjwt","slug":"not-intended-to-be-called","errorCode":null,"errorMessage":"Not intended to be called.","messagePattern":"Not intended to be called\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/StandardKeyAlgorithms.java","lineNumber":100,"sourceCode":"\n        // ensure that the bare minimum steps are performed to hash, ensuring our time sampling pertains only to\n        // hashing and not ancillary steps needed to setup the hashing/derivation\n        return new KeyAlgorithm<Password, Password>() {\n            @Override\n            public KeyResult getEncryptionKey(KeyRequest<Password> request) throws SecurityException {\n                int iterations = request.getHeader().getPbes2Count();\n                char[] password = request.getKey().getPassword();\n                try {\n                    alg.deriveKey(factory, password, rfcSalt, iterations);\n                } catch (Exception e) {\n                    throw new SecurityException(\"Unable to derive key\", e);\n                }\n                return null;\n            }\n\n            @Override\n            public SecretKey getDecryptionKey(DecryptionKeyRequest<Password> request) throws SecurityException {\n                throw new UnsupportedOperationException(\"Not intended to be called.\");\n            }\n\n            @Override\n            public String getId() {\n                return alg.getId();\n            }\n        };\n    }\n\n    private static char randomChar() {\n        return (char) Randoms.secureRandom().nextInt(Character.MAX_VALUE);\n    }\n\n    private static char[] randomChars(@SuppressWarnings(\"SameParameterValue\") int length) {\n        char[] chars = new char[length];\n        for (int i = 0; i < length; i++) {\n            chars[i] = randomChar();\n        }","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/StandardKeyAlgorithms.java#L82-L118","documentation":"An UnsupportedOperationException stating 'Not intended to be called.' thrown from the anonymous Password KeyResult's getDecryptionKey method. This is an internal invariant guard: the PBES2 wrapper implements getEncryptionKey only, and decryption keys are resolved through a different path, so calling this method means the library internals were invoked incorrectly.","triggerScenarios":"Only when internal code or a custom KeyAlgorithm extension calls getDecryptionKey on the password-based KeyResult returned by StandardKeyAlgorithms for encryption; normal user code never triggers it.","commonSituations":"Almost exclusively hit by library contributors or by custom crypto implementations that reuse StandardKeyAlgorithms results in unsupported ways; possibly after a jjwt version upgrade mixing mismatched impl classes.","solutions":["Do not call getDecryptionKey on the KeyResult of a password (PBES2) algorithm; use the parser's decryptWith(password) API instead.","If writing a custom KeyAlgorithm, implement decryption via the DecryptionKeyRequest path your own class provides.","If hit during normal use, report it as a jjwt bug including the stack trace and version.","Ensure all jjwt artifacts (api/impl/jackson) are the same version."],"exampleFix":"// before\nSecretKey key = passwordKeyResult.getDecryptionKey(request); // UnsupportedOperationException\n// after\nSecretKey key = Jwts.KEY.get(password, StandardKeyAlgorithms.PBES2_HS256_A128KW.getId()); // proper API path\n// or simply: Jwts.parser().decryptWith(password)","handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use only public jjwt APIs (Jwts.parser().decryptWith) instead of impl internals","Never call getDecryptionKey on PBES2 KeyResults","Pin all jjwt artifact versions together","If implementing a custom KeyAlgorithm, implement both directions via the proper request types"],"tags":["jwt","unsupported-operation","internal"],"backgroundTag":"method-not-implemented","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}