Broken auth (weak JWT)

A fake token checker accepts the dangerous alg=none trick. Forge an admin role — only here.

1) The idea

JWTs have a header that says how the signature was made. A buggy verifier that trusts alg=none skips the signature check.

2) Try it

Get a guest token, then edit the payload so role is admin and set the header alg to none with an empty signature.

Hint 1

Header and payload are base64url JSON. Signature can be empty when alg is none.

Hint 2

Header: {"alg":"none","typ":"JWT"} — payload role admin — signature empty.

3) The fix

Allow-list algorithms (e.g. only HS256/RS256). Reject none. Use a strong secret or asymmetric keys. Check audience/expiry. Prefer battle-tested libraries.