jwtk/jjwt · error · MalformedJwtException

${name()} is missing required ${param} value.

Error message

${name()} is missing required ${param} value.

What it means

A MalformedJwtException (via malformed()) raised when a required Parameter named by the JWT/JWK document is absent (null) from the parsed source. RequiredParameterReader.get enforces that every parameter marked required in a spec (e.g. an RSA JWK's 'n' and 'e', or a JWE header's required claims) is present; missing ones make the object invalid. The message names the owner (name()) and the missing parameter.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/lang/RequiredParameterReader.java:56

    private String name() {
        return ((Nameable) this.src).getName();
    }

    private JwtException malformed(String msg) {
        if (this.src instanceof JwkContext || this.src instanceof Jwk) {
            return new MalformedKeyException(msg);
        } else {
            return new MalformedJwtException(msg);
        }
    }

    @Override
    public <T> T get(Parameter<T> param) {
        T value = this.src.get(param);
        if (value == null) {
            String msg = name() + " is missing required " + param + " value.";
            throw malformed(msg);
        }
        return value;
    }
}

View on GitHub (pinned to fb71496164)

Solutions

1. Add the missing required parameter to the token/JWK before use (e.g. include 'n' and 'e' in an RSA JWK).
2. Check whether an upstream proxy or serializer is dropping null/empty fields and disable that behavior.
3. Catch MalformedJwtException and reject the token with a clear 401/400 response.
4. Regenerate the key/token with jjwt's builder so all required fields are emitted.

Example fix

// before: JWK map missing 'e'
{ "kty":"RSA", "n":"..." }
// after
{ "kty":"RSA", "n":"...", "e":"AQAB" }

// for JWKs: check required fields before use
if (!jwkMap.containsKey("n") || !jwkMap.containsKey("e"))
    throw new InvalidJwkException("RSA JWK missing n/e");

boolean hasRequired = jwkMap != null && jwkMap.containsKey("kty") && jwkMap.get("kty") != null;

try {
    return Jwts.parser().verifyWith(key).build().parseSignedClaims(token);
} catch (MalformedJwtException e) {
    throw new UnauthorizedException("JWT missing required claims", e);
}

When it happens

Trigger: Parsing or processing a JWK/JWT whose header, payload, or key parameters omit a field the spec requires, e.g. an EC JWK without 'crv', a protected header without the required algorithm/claim, when calling get(param) on the reader during processing.

Common situations: Hand-built or third-party tokens/JWKs missing mandatory fields; stripping claims in a gateway; storing JWKs in a database with nullable columns and re-serializing partial objects.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• JWK is missing required kty parameter.
• JWK kty value cannot be null.
• JWK kty value cannot be empty.
• RSA JWK 'oth' (Other Prime Info) element cannot be null.
• Unrelated key operations are not allowed. KeyOperation [${in

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/fb4533999c9cc179. Report an issue: GitHub.