JWT Attack Detection

When to Use

Audit JWT verification/generation libraries, authentication implementations, and any code that validates or creates JSON Web Tokens.

Attack Types

1. Algorithm Confusion (RS256 to HS256)

The server uses RS256 (asymmetric) but the attacker changes the token header to HS256 (symmetric) and signs with the public key as the HMAC secret.

Conditions: Library accepts algorithm from token header without allowlist validation.

2. alg:none Bypass

Token header specifies "alg": "none", and the library accepts unsigned tokens.

Conditions: Library does not validate algorithm or allows "none".