The alg:none attack

Key points

• The header declares the algorithm - and the header is supplied by whoever sends the token.
• An attacker sets alg: "none", strips the signature, and edits the payload freely.
• A naive library reads the header, sees "none", and reports the token as valid.
• The fix: the verifier must decide the expected algorithm, never take it from the token.
• A related attack swaps RS256 for HS256 and signs with the public key as the HMAC secret.

Example

// WRONG - trusts the algorithm the attacker chose
Jwts.parser().setSigningKey(key).parse(token);

// RIGHT - the verifier fixes the algorithm
Jwts.parser()
    .verifyWith(publicKey)
    .sig().add(Jwts.SIG.RS256).and()   // only RS256 accepted
    .build()
    .parseSignedClaims(token);

Never let the token tell you how to verify it - pin the algorithm on the server.