Question 1

What is the alg:none attack?

Accepted Answer

JWTs name their signing algorithm in the header. If the header says 'alg': 'none', the token carries no signature — and a verifier that honours that header will accept a completely unsigned, attacker-crafted payload. The fix is to never accept 'none' and to pin the expected algorithm on the server rather than trusting the header.

Question 2

How does the RS256 to HS256 confusion attack work?

Accepted Answer

RS256 verifies with an asymmetric public/private key pair; HS256 verifies with a shared symmetric secret. If a server that issues RS256 tokens naively verifies whatever algorithm the header claims, an attacker can send an HS256 token signed with the server's public key (which is not secret). Enforcing the expected algorithm at verification time prevents this.

Question 3

Why do missing exp and broad scopes matter?

Accepted Answer

Without an exp (expiration) claim, a stolen token is valid forever, so servers should require and enforce a short expiry. An over-broad scope such as '*' or a self-asserted 'admin: true' violates least privilege — if the token leaks, the attacker gets everything. Authorization should be derived server-side, never trusted blindly from claims.

JWT Claims Audit

How to play

Frequently Asked Questions