zakirkun Weak JWT Algorithm
Overview
JWT algorithm issues include:
- HS256 with short key: HS256 keys shorter than 256 bits are brute-forceable
- Algorithm confusion (RS256 → HS256): Public key used as HMAC secret when server accepts both
- Explicit
nonealgorithm: No signature required - Embedded JWK in header: Attacker provides their own public key
Remediation
- Use RS256 or ES256 for production systems (asymmetric keys)
- If using HS256, use a random 32+ byte secret
- Restrict accepted algorithms explicitly:
algorithms: ['RS256'] - Never allow
nonealgorithm