JWT Misuse Anti-Pattern

Severity: High

Summary

JSON Web Tokens (JWTs) are frequently misused in AI-generated code, creating critical vulnerabilities. Common flaws include accepting the "none" algorithm, weak secrets, sensitive data in payloads, and missing expiration. These enable authentication bypass, token forgery, and sensitive data exposure.

The Anti-Patterns and Solutions

1. Algorithm Confusion ("none" Algorithm Attack)

Critical vulnerability where library accepts any algorithm in token header. Attacker changes algorithm to "none" and removes signature, bypassing all cryptographic validation.

BAD Code Example

# VULNERABLE: Accepts whatever algorithm is in the header
import jwt