Error(InvalidAlgorithm)

`{:?}` prints `Error(InvalidAlgorithm)`, `{}` prints `InvalidAlgorithm`.

jsonwebtoken (Rust crate) — ErrorKind::InvalidAlgorithm from decode()

What it means

The token's `alg` is not in `validation.algorithms`, or it does not fit the family of the `DecodingKey` (an EC key cannot verify RS256). The check happens before any signature verification. The most common trigger is `Validation::default()`, which allows HS256 only.

Why it happens

• Validation::default() with an asymmetric token

  common

  `Validation::default()` is `Validation::new(Algorithm::HS256)`. Tokens from identity providers are usually RS256 or ES256 and fail immediately.

• The issuer changed algorithm

  occasional

  A provider migration (for example RS256 → ES256) breaks verifiers that pin the old algorithm.

• Key and algorithm from different families

  occasional

  Listing both RS256 and ES256 does not help if the `DecodingKey` is an RSA key and the token is ES256: the key's family must match the token's algorithm.

How to fix it

1. 1.

   Build the Validation for the issuer's algorithm

   Use `Validation::new` with the issuer's algorithm and set the expected issuer and audience at the same time — the defaults do not check them.

   let mut validation = Validation::new(Algorithm::ES256); // the issuer's algorithm
   validation.set_issuer(&["https://issuer.example.com/"]);
   validation.set_audience(&["api://orders"]);
   let data = decode::<Claims>(&token, &key, &validation)?;

← Browse the full signature error database