"alg" (Algorithm) Header Parameter value not allowed

jose (JavaScript) — JOSEAlgNotAllowed, code ERR_JOSE_ALG_NOT_ALLOWED

What it means

The token's alg header names an algorithm that is not in the algorithms allowlist you passed to jwtVerify, or does not match the key's declared algorithm. jose refuses before any cryptography runs. This gate is deliberate: the alg header is attacker-controlled input, and the verifier — not the token — must choose the algorithm.

Why it happens

• Allowlist out of sync with the issuer

  common

  The issuer moved from RS256 to ES256 (or added a new signing key with a different algorithm) while the verifier still pins the old family. Every new token fails until the allowlist and keys are updated together — and the failures start at the exact minute of the issuer's rollout, a useful forensic signature in logs.

• Key alg metadata conflicts with the token

  common

  A JWK imported with alg: "RS256" (or a CryptoKey generated for a different algorithm) cannot verify an ES256 token even if you widen the allowlist — jose cross-checks the key's algorithm against the header.

• A hostile or misconfigured client varies alg

  rare

  Tokens arriving with alg: "none" or an unexpected HS* value are exactly what this check exists to stop. If you see foreign algorithms in logs, treat it as probing, not as a bug to accommodate.

How to fix it

1. 1.

   Align allowlist, key and issuer configuration

   Look at the header, then make all three agree. During migrations, accept both algorithms temporarily, each served by its own key via JWKS kid.

   import { decodeProtectedHeader, jwtVerify } from "jose";
   
   console.log(decodeProtectedHeader(token)); // { alg: "ES256", kid: "..." }
   await jwtVerify(token, jwks, { algorithms: ["ES256"] });

2. 2.

   Keep the allowlist as small as possible

   Do not "fix" this error by listing every algorithm. One value per token type is the safe end state; RFC 8725 (JWT Best Current Practices) says the same.

   // good: exactly what your issuer signs with
   { algorithms: ["ES256"] }
   // bad: defeats the protection this error provides
   { algorithms: ["ES256", "RS256", "HS256", "PS256"] }

← Browse the full signature error database