Web Security · Middle · Question 42 of 75

What is the `alg: none` attack on JWTs?

1Using a token with no expiry date
2Sending a token without the Bearer prefix
✓Correct answer: The attacker sets the algorithm to none and removes the signature, and a careless library accepts the token

Explanation

Always pin the allowed algorithms on the server instead of trusting the alg from the token header.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.