Intermediate LevelAuthentication & Authorization
What was the JWT "none" algorithm vulnerability and how do modern libraries defend against it?
❓ Interview Prompt: Explain the JWT "alg": "none" vulnerability, key confusion attacks, and enforcing strict algorithm whitelists.
The JWT '"none"' Algorithm Vulnerability is one of the most famous flaws in early JWT library implementations:
How the Exploit Worked:
1
Attacker takes a valid JWT, modifies the payload (changing 'role: "user"' to 'role: "admin"').
2
Attacker modifies the JWT header to '{"alg": "none"}' and strips the signature section.
3
Flawed JWT libraries saw '"alg": "none"', bypassed signature verification entirely, and trusted the forged admin claims!
Modern Defenses:
Modern JWT verification functions require an explicit algorithm whitelist (e.g. 'algorithms: ['RS256']') and reject any token specifying '"none"' or un-approved algorithms.
Code Implementation Example
typescript
import jwt from 'jsonwebtoken';
// SECURE: Enforces strict algorithm whitelist, rejecting "none" or algorithm switching
function verifyJwtSecure(token: string, secretOrPublicKey: string) {
return jwt.verify(token, secretOrPublicKey, {
algorithms: ['RS256'] // Explicitly reject "none" or "HS256" substitution attempts!
});
}💡Enforcing strict algorithm whitelisting in JWT verification.
🎯 Interview Key Takeaway
Defend against JWT "none" and key confusion attacks by enforcing strict algorithm whitelists during token verification.
#JWT Vulnerabilities#None Algorithm#Security#Signatures#Intermediate
Back to all Authentication & Authorization Questions→