jwtk/jjwt · error · UnsupportedJwtException

Unexpected unsecured content JWT.

Error message

Unexpected unsecured content JWT.

What it means

Thrown by onUnsecuredContent when visit() encounters a JWT that is neither signed nor encrypted and has a raw byte[] payload. JJWT's default visitor refuses unsecured (alg=none) JWTs because they carry no integrity protection, so accepting them is an application-level security decision; overriding this method is the intended way to opt in.

Source

Thrown at api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java:74

            return onUnsecuredClaims((Jwt<Header, Claims>) jwt);
        }
    }

    /**
     * Handles an encountered unsecured content JWT - one that is not cryptographically signed nor
     * encrypted, and has a byte[] array payload. If the JWT creator has set the (optional)
     * {@link Header#getContentType()} value, the application may inspect that value to determine how to convert
     * the byte array to the final type as desired.
     *
     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that
     * subclasses will override this method if the application needs to support this type of JWT.</p>
     *
     * @param jwt the parsed unsecured content JWT
     * @return any object to be used after inspecting the JWT, or {@code null} if no return value is necessary.
     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.
     */
    public T onUnsecuredContent(Jwt<Header, byte[]> jwt) throws UnsupportedJwtException {
        throw new UnsupportedJwtException("Unexpected unsecured content JWT.");
    }

    /**
     * Handles an encountered unsecured Claims JWT - one that is not cryptographically signed nor
     * encrypted, and has a {@link Claims} payload.
     *
     * <p>The default implementation immediately throws an {@link UnsupportedJwtException}; it is expected that
     * subclasses will override this method if the application needs to support this type of JWT.</p>
     *
     * @param jwt the parsed unsecured content JWT
     * @return any object to be used after inspecting the JWT, or {@code null} if no return value is necessary.
     * @throws UnsupportedJwtException by default, expecting the subclass implementation to override as necessary.
     */
    public T onUnsecuredClaims(Jwt<Header, Claims> jwt) {
        throw new UnsupportedJwtException("Unexpected unsecured Claims JWT.");
    }

    /**

View on GitHub (pinned to fb71496164)

Solutions

1. If unsecured JWTs are expected and safe in your context, subclass SupportedJwtVisitor and override onUnsecuredContent to consume the byte[] payload (inspect Header#getContentType to decide conversion) instead of throwing UnsupportedJwtException
2. If unsecured JWTs are not expected, reject the token before parsing or at the issuer/source level — an unsecured JWT must never be trusted as authenticated data
3. Switch the token producer to use a signed JWT (e.g. HS256/RS256) so the default visitor path is not hit

When it happens

Trigger: Thrown at api/src/main/java/io/jsonwebtoken/SupportedJwtVisitor.java:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/fd93a73a01e1c2d3. Report an issue: GitHub.