Signed JWSs/JWTs are not supported

When I use Jwts.parser().parsePlaintextJws(token) on one of my tokens, I get an exception with something like “Signed JWSs/JWTs are not supported”.

That doesn’t make much sense to me. Am I doing this wrong?

I want to look at my own token on the client, to read the fields. I can’t give the secret to the client. Will I need to use a different library? What is the reason that I can’t read fields in a signed token if the token isn’t encrypted?

https://jwt.io/ can read all fields.

[gposcidonio]

Oh I think I misread your first comment when I saw it initially. So the idea behind JWT is that you rely on the signature to tell you whether the token you have is valid or not. If you can’t verify the signature then you shouldn’t trust any of its contents. If you can’t give your client the private key you’re using to sign the keys, perhaps consider using an asymmetric signing algorithm such as RS256 so that your server can have the private key and you can give your client(s) the public key. For more on this topic, you can check out this StackOverflow post.

[lhazlewood]

closing per @gposcidonio and @dogeared last comments. Also note that the term ‘plaintext jwt’ is no longer valid upon finalization of RFC 7519 (they removed that term and the support for arbitrary text payloads and now have only JSON Claims Set payloads that maybe secure or unsecure). We’ll remove ‘parsePlaintext*’ method variants from JJWT before the 1.0 final release to stay consistent with the RFC.