Web Security · Senior · Question 33 of 75

What is the JWT algorithm confusion attack (RS256 to HS256)?

✓Correct answer: The attacker signs a token with HS256 using the server's public RSA key as the HMAC secret, and a naive verifier accepts it
2Using a weaker hash function than SHA-256
3Sending two tokens with different algorithms

Explanation

If the library picks the algorithm from the token header, the public key becomes a shared secret. Pin the expected algorithm per key.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.