{"record":{"id":"ecbe9c9af8dacac7","repo":"honojs/hono","slug":"crypto-subtle-importkey-is-undefined-jwk-auth-m","errorCode":null,"errorMessage":"`crypto.subtle.importKey` is undefined. JWK auth middleware requires it.","messagePattern":"`crypto\\.subtle\\.importKey` is undefined\\. JWK auth middleware requires it\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/middleware/jwk/jwk.ts","lineNumber":75,"sourceCode":"\n    headerName?: string\n\n    alg: AsymmetricAlgorithm[]\n\n    realm?: string\n\n    verification?: VerifyOptions\n  },\n  init?: RequestInit\n): MiddlewareHandler => {\n  const verifyOpts = options.verification || {}\n\n  if (!options || !(options.keys || options.jwks_uri)) {\n    throw new Error('JWK auth middleware requires options for either \"keys\" or \"jwks_uri\" or both')\n  }\n\n  if (!crypto.subtle || !crypto.subtle.importKey) {\n    throw new Error('`crypto.subtle.importKey` is undefined. JWK auth middleware requires it.')\n  }\n\n  return async function jwk(ctx, next) {\n    const headerName = options.headerName || 'Authorization'\n\n    const credentials = ctx.req.raw.headers.get(headerName)\n    let token\n    if (credentials) {\n      const parts = credentials.split(/\\s+/)\n      if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {\n        const errDescription = 'invalid credentials structure'\n        throw new HTTPException(401, {\n          message: errDescription,\n          res: unauthorizedResponse({\n            ctx,\n            error: 'invalid_request',\n            errDescription,\n            realm: options.realm,","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/honojs/hono/blob/e2740d5a1bd0b4254e517e3af8b60789284bc7bd/src/middleware/jwk/jwk.ts#L57-L93","documentation":"The JWK middleware verifies tokens with WebCrypto (crypto.subtle.importKey). If the runtime's global crypto.subtle is absent — typically because the page/worker is not in a secure context (not HTTPS/localhost) or the runtime lacks WebCrypto — the middleware refuses to initialize.","triggerScenarios":"Running the app in a plain-HTTP non-localhost environment (secure context required for crypto.subtle), an older Node without WebCrypto (pre-18 or without node:crypto webcrypto shimming), or a browser/worker sandbox where crypto.subtle is undefined.","commonSituations":"Local testing over http:// on a LAN IP or a container accessed by IP; deploying behind a TLS-terminating proxy to a non-secure origin; using an embedded JS engine or old runtime without WebCrypto; certain edge/testing setups (jsdom-based tests) that stub crypto incompletely.","solutions":["Serve the app over HTTPS, or use http://localhost / http://127.0.0.1 which are secure contexts","On Node <18, upgrade to Node 18+ where crypto.subtle is global; alternatively polyfill via node:crypto's webcrypto export","In test environments, polyfill crypto.subtle (e.g. import 'crypto' webcrypto assignment) before importing the middleware","Verify with a quick runtime check: typeof crypto !== 'undefined' && !!crypto.subtle"],"exampleFix":"// before (Node 16, crypto.subtle undefined)\n// after: run on Node 18+, or add:\nimport { webcrypto } from 'node:crypto'\nif (!globalThis.crypto?.subtle) (globalThis as any).crypto = webcrypto","handlingStrategy":"validation","validationCode":"const hasWebCrypto = (): boolean =>\n  typeof crypto !== 'undefined' && !!crypto.subtle && typeof crypto.subtle.importKey === 'function'\nif (!hasWebCrypto()) { /* polyfill or refuse to start */ }","typeGuard":"const supportsJwkRuntime = (): boolean => typeof crypto !== 'undefined' && typeof crypto.subtle?.importKey === 'function'","tryCatchPattern":"try { app.use('/api/*', jwk({ jwks_uri })) } catch (e) { if (e instanceof Error && e.message.includes('crypto.subtle')) { throw new Error('Serve over HTTPS/localhost or polyfill webcrypto') } throw e }","preventionTips":["Run on Node 18+ or polyfill node:crypto webcrypto","Use HTTPS or localhost in dev; non-localhost plain HTTP is not a secure context","Include a crypto.subtle availability check in health checks for restricted runtimes"],"tags":["jwk","webcrypto","secure-context","nodejs","environment"],"backgroundTag":"crypto-subtle-unavailable","analyzedSha":"e2740d5a1bd0b4254e517e3af8b60789284bc7bd","analyzedAt":"2026-08-28T10:18:08.750Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}