Skip to content

Preserve IOException cause in JWTParser decode errors#781

Open
asim-alam wants to merge 1 commit into
auth0:masterfrom
asim-alam:fix/preserve-jwtparser-exception-cause
Open

Preserve IOException cause in JWTParser decode errors#781
asim-alam wants to merge 1 commit into
auth0:masterfrom
asim-alam:fix/preserve-jwtparser-exception-cause

Conversation

@asim-alam

Copy link
Copy Markdown

Changes

JWTParser.parsePayload and JWTParser.parseHeader catch the Jackson IOException
thrown while parsing a token's JSON, but rethrow it as a JWTDecodeException without
passing the original exception as the cause. As a result, Jackson's parsing details,
including the message and source location, are lost from the exception chain.

This PR forwards the caught IOException as the cause:

  • Added a private decodeException(String json, Throwable cause) overload in JWTParser
    that builds the same message and passes the cause through.
  • Updated the two catch (IOException e) sites in parsePayload and parseHeader to use it.
  • No public API change: JWTDecodeException already has a (String, Throwable) constructor.
  • No behavior change beyond the fix: the exception type and message are unchanged;
    only getCause() on the parse-failure path changes from null to the underlying Jackson exception.

Before:

getCause() : null

After:

getCause() : com.fasterxml.jackson.core.JsonParseException: Unexpected close marker '}' ...

References

Found via static analysis: PMD's PreserveStackTrace rule flags both catch sites.

No related support ticket or community post.

Testing

  • Added JWTParserTest.shouldPreserveCauseWhenParsingInvalidJson, which asserts the thrown
    JWTDecodeException's cause is the underlying IOException.

  • Ran the full module suite with ./gradlew :java-jwt:test: 680 tests, 0 failures

  • This change adds unit test coverage

  • This change has been tested on the latest version of the platform/language

Checklist

  • I have read the Auth0 general contribution guidelines
  • I have read the Auth0 Code of Conduct
  • All existing and new tests complete without errors

JWTParser was wrapping malformed JSON errors in a JWTDecodeException without keeping the original IOException as the cause.

This change passes the original IOException through so callers can inspect the root cause. It also adds a regression test for malformed JSON parsing.
@asim-alam asim-alam requested a review from a team as a code owner June 27, 2026 06:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant