SharePoint / SharePoint/sp-dev-docs
SPAppToken encryption change breaks SharePoint app
Open
@Ashlesha-MSFT is already working on this.
Since Dec 1, 2025.
area:add-ins
sharepoint-developer-support
type:bug-suspected
- Dominant language
- PowerShell
- Stars
- 1.4k
- Forks
- 1.1k
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 12
Description
Target SharePoint environment
SharePoint Online
What SharePoint development model, framework, SDK or API is this about?
SharePoint Add-ins
Developer environment
None
What browser(s) / client(s) have you tested
- 💥 Internet Explorer
- 💥 Microsoft Edge
- 💥 Google Chrome
- 💥 FireFox
- 💥 Safari
- mobile (iOS/iPadOS)
- mobile (Android)
- not applicable
- other (enter in the "Additional environment details" area below)
Additional environment details
- browser version
- SPFx version
- Node.js version
- etc
Describe the bug / error
While preparing to update our SharePoint Add-in to SPFX we started having a new issue. For some reason validation of the SPAppToken started failing in TokenHandler.
'System.NotSupportedException: IDX10634: Unable to create the SignatureProvider.
Algorithm: 'RS256', SecurityKey: 'Null'
After examining the token it now appears to report the algorithm used for its signature as RS256 which is not something that is symmetrically encrypted using our client id as it was for 9 years until now.
Steps to reproduce
- Create SP Addin
- Try to login via appredirect.aspx
- Token validation fails
Expected behavior
Token is encrypted with symmetric algorithm using client secret of our add-in.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.