lcobucci/jwt · error · Lcobucci\JWT\Token\UnsupportedHeaderFound

Encryption is not supported yet

Error message

Encryption is not supported yet

What it means

Parser::parseHeader() rejects JWE-style headers: if the decoded header contains the 'enc' (content encryption algorithm) claim, UnsupportedHeaderFound::encryption() is thrown because this library does not support encrypted JWTs (JWE), only signed JWS tokens.

Solutions

1. Disable token encryption at the identity provider / configure it to emit signed (JWS) tokens instead of JWE
2. Use a library that supports JWE (e.g. web-token/jwt-framework) if you must handle encrypted tokens
3. Check the token has 3 segments (JWS), not 5 (JWE), before parsing
4. Catch UnsupportedHeaderFound and return a clear 'encrypted tokens not supported' error

Example fix

// before
$token = $parser->parse($jwt); // jwt is a 5-part JWE
// after
if (substr_count($jwt, '.') !== 2) {
    throw new InvalidArgumentException('Encrypted JWTs (JWE) are not supported; use web-token/jwt-framework');
}
$token = $parser->parse($jwt);

if (substr_count($jwt, '.') === 5) { throw new InvalidArgumentException('JWE detected; not supported'); }

try { $token = $parser->parse($jwt); } catch (Lcobucci\JWT\UnsupportedHeaderFound $e) { return error_401('Encrypted tokens are not supported'); }

When it happens

Trigger: Parsing a JWE compact serialization (5 segments) or a token whose header includes an 'enc' member, e.g. {"alg":"RSA-OAEP","enc":"A256GCM"}.

Common situations: Receiving encrypted ID tokens from an OIDC provider with JWE enabled; mixing up JWS and JWE tokens; configuring the identity provider to encrypt (not just sign) tokens.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• You should pass a plain token
• No constraint given.
• Error while encoding to JSON
• Key provided is shorter than
• Key cannot be empty

AI-assisted analysis of lcobucci/jwt@375813049c (2026-09-14). Data as JSON: /api/errors/c857fa072ebad4da. Report an issue: GitHub.

Appendix: source

Thrown at src/Token/Parser.php:92

     * @param non-empty-string $data
     *
     * @return array<non-empty-string, mixed>
     *
     * @throws UnsupportedHeaderFound When an invalid header is informed.
     * @throws InvalidTokenStructure  When parsed content isn't an array.
     */
    private function parseHeader(string $data): array
    {
        $header = $this->decoder->jsonDecode($this->decoder->base64UrlDecode($data));

        if (! is_array($header)) {
            throw InvalidTokenStructure::arrayExpected('headers');
        }

        $this->guardAgainstEmptyStringKeys($header, 'headers');

        if (array_key_exists('enc', $header)) {
            throw UnsupportedHeaderFound::encryption();
        }

        if (! array_key_exists('typ', $header)) {
            $header['typ'] = 'JWT';
        }

        return $header;
    }

    /**
     * Parses the claim set from a string
     *
     * @param non-empty-string $data
     *
     * @return array<non-empty-string, mixed>
     *
     * @throws InvalidTokenStructure When parsed content isn't an array or contains non-parseable dates.
     */

View on GitHub (pinned to 375813049c)