{"record":{"id":"fd93a73a01e1c2d3","repo":"jwtk/jjwt","slug":"unexpected-unsecured-content-jwt","errorCode":null,"errorMessage":"Unexpected unsecured content JWT.","messagePattern":"Unexpected unsecured content JWT\\.","errorType":"exception","errorClass":"UnsupportedJwtException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java","lineNumber":74,"sourceCode":"            return onUnsecuredClaims((Jwt<Header, Claims>) jwt);\n        }\n    }\n\n    /**\n     * Handles an encountered unsecured content JWT - one that is not cryptographically signed nor\n     * encrypted, and has a byte[] array payload. If the JWT creator has set the (optional)\n     * {@link Header#getContentType()} value, the application may inspect that value to determine how to convert\n     * the byte array to the final type as desired.\n     *\n     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that\n     * subclasses will override this method if the application needs to support this type of JWT.</p>\n     *\n     * @param jwt the parsed unsecured content JWT\n     * @return any object to be used after inspecting the JWT, or {@code null} if no return value is necessary.\n     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.\n     */\n    public T onUnsecuredContent(Jwt<Header, byte[]> jwt) throws UnsupportedJwtException {\n        throw new UnsupportedJwtException(\"Unexpected unsecured content JWT.\");\n    }\n\n    /**\n     * Handles an encountered unsecured Claims JWT - one that is not cryptographically signed nor\n     * encrypted, and has a {@link Claims} payload.\n     *\n     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that\n     * subclasses will override this method if the application needs to support this type of JWT.</p>\n     *\n     * @param jwt the parsed unsecured content JWT\n     * @return any object to be used after inspecting the JWT, or {@code null} if no return value is necessary.\n     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.\n     */\n    public T onUnsecuredClaims(Jwt<Header, Claims> jwt) {\n        throw new UnsupportedJwtException(\"Unexpected unsecured Claims JWT.\");\n    }\n\n    /**","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java#L56-L92","documentation":"Thrown by onUnsecuredContent when visit() encounters a JWT that is neither signed nor encrypted and has a raw byte[] payload. JJWT's default visitor refuses unsecured (alg=none) JWTs because they carry no integrity protection, so accepting them is an application-level security decision; overriding this method is the intended way to opt in.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["If unsecured JWTs are expected and safe in your context, subclass SupportedJwtVisitor and override onUnsecuredContent to consume the byte[] payload (inspect Header#getContentType to decide conversion) instead of throwing UnsupportedJwtException","If unsecured JWTs are not expected, reject the token before parsing or at the issuer/source level — an unsecured JWT must never be trusted as authenticated data","Switch the token producer to use a signed JWT (e.g. HS256/RS256) so the default visitor path is not hit"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}