jwtk/jjwt · error · UnsupportedJwtException

Unexpected unsecured content JWT.

Error message

Unexpected unsecured content JWT.

What it means

Thrown by onUnsecuredContent when visit() encounters a JWT that is neither signed nor encrypted and has a raw byte[] payload. JJWT's default visitor refuses unsecured (alg=none) JWTs because they carry no integrity protection, so accepting them is an application-level security decision; overriding this method is the intended way to opt in.

Solutions

1. If unsecured JWTs are expected and safe in your context, subclass SupportedJwtVisitor and override onUnsecuredContent to consume the byte[] payload (inspect Header#getContentType to decide conversion) instead of throwing UnsupportedJwtException
2. If unsecured JWTs are not expected, reject the token before parsing or at the issuer/source level — an unsecured JWT must never be trusted as authenticated data
3. Switch the token producer to use a signed JWT (e.g. HS256/RS256) so the default visitor path is not hit

When it happens

Trigger: Thrown at api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/fd93a73a01e1c2d3. Report an issue: GitHub.

Appendix: source

Thrown at api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java:74

            return onUnsecuredClaims((Jwt<Header, Claims>) jwt);
        }
    }

    /**
     * Handles an encountered unsecured content JWT - one that is not cryptographically signed nor
     * encrypted, and has a byte[] array payload. If the JWT creator has set the (optional)
     * {@link Header#getContentType()} value, the application may inspect that value to determine how to convert
     * the byte array to the final type as desired.
     *
     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that
     * subclasses will override this method if the application needs to support this type of JWT.</p>
     *
     * @param jwt the parsed unsecured content JWT
     * @return any object to be used after inspecting the JWT, or {@code null} if no return value is necessary.
     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.
     */
    public T onUnsecuredContent(Jwt<Header, byte[]> jwt) throws UnsupportedJwtException {
        throw new UnsupportedJwtException("Unexpected unsecured content JWT.");
    }

    /**
     * Handles an encountered unsecured Claims JWT - one that is not cryptographically signed nor
     * encrypted, and has a {@link Claims} payload.
     *
     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that
     * subclasses will override this method if the application needs to support this type of JWT.</p>
     *
     * @param jwt the parsed unsecured content JWT
     * @return any object to be used after inspecting the JWT, or {@code null} if no return value is necessary.
     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.
     */
    public T onUnsecuredClaims(Jwt<Header, Claims> jwt) {
        throw new UnsupportedJwtException("Unexpected unsecured Claims JWT.");
    }

    /**

View on GitHub (pinned to fb71496164)