lcobucci/jwt · error · ConstraintViolation

Token signer mismatch

Error message

Token signer mismatch

What it means

Thrown by SignedWith::assert() when the token header's alg value differs from the algorithm of the configured signer. The constraint verifies the signature with a specific Signer/Key pair, so a token signed with any other algorithm (e.g. an HS256 token checked against an RS256 signer) fails this check before signature verification even runs.

Solutions

1. Configure the SignedWith constraint with the same signer algorithm (and key) that the token issuer used to sign the token
2. If you are the issuer, ensure the alg header matches the algorithm actually used for signing
3. Reject tokens with unexpected algorithms rather than accepting multiple algorithms implicitly; pin the expected signer explicitly

When it happens

Trigger: Thrown at src/Validation/Constraint/SignedWith.php:25 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of lcobucci/jwt@375813049c (2026-09-14). Data as JSON: /api/errors/b77bebf09183203b. Report an issue: GitHub.

Appendix: source

Thrown at src/Validation/Constraint/SignedWith.php:25

use Lcobucci\JWT\Token;
use Lcobucci\JWT\UnencryptedToken;
use Lcobucci\JWT\Validation\ConstraintViolation;
use Lcobucci\JWT\Validation\SignedWith as SignedWithInterface;

final readonly class SignedWith implements SignedWithInterface
{
    public function __construct(private Signer $signer, private Signer\Key $key)
    {
    }

    public function assert(Token $token): void
    {
        if (! $token instanceof UnencryptedToken) {
            throw ConstraintViolation::error('You should pass a plain token', $this);
        }

        if ($token->headers()->get('alg') !== $this->signer->algorithmId()) {
            throw ConstraintViolation::error('Token signer mismatch', $this);
        }

        if (! $this->signer->verify($token->signature()->hash(), $token->payload(), $this->key)) {
            throw ConstraintViolation::error('Token signature mismatch', $this);
        }
    }
}

View on GitHub (pinned to 375813049c)