Exploit Analysis: The JWT Algorithm 'none' Attack (And the Guard)

// ❌ This looks fine...
const decoded = jwt.verify(token, secret, {
  algorithms: ['HS256', 'none'], // 💀 The vulnerability
});

// 1. Attacker takes a valid JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTYiLCJyb2xlIjoidXNlciJ9.
signature_here

// 2. Modifies the header to use "none" algorithm:
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.
eyJzdWIiOiIxMjM0NTYiLCJyb2xlIjoiYWRtaW4ifQ.
// No signature needed!

// 3. Server accepts it because "none" is in algorithms list
// Attacker is now admin

// ✅ Explicitly whitelist algorithms
const decoded = jwt.verify(token, secret, {
  algorithms: ['HS256'], // Only what you use!
});

// ❌ Dangerous
jwt.verify(token, secret, { algorithms: ['none'] });

// ✅ Safe
jwt.verify(token, secret, { algorithms: ['HS256'] });

// ❌ Dangerous: RS256 token verified with symmetric secret
jwt.verify(token, publicKey);

// ✅ Safe: Explicit algorithm
jwt.verify(token, publicKey, { algorithms: ['RS256'] });

// ❌ Dangerous: Brute-forceable
jwt.sign(payload, 'password123');

// ✅ Safe: Strong secret
jwt.sign(payload, process.env.JWT_SECRET); // 256+ bits

// ❌ Dangerous: Token valid forever
jwt.sign({ userId: 123 }, secret);

// ✅ Safe: Short expiration
jwt.sign({ userId: 123 }, secret, { expiresIn: '1h' });

// ❌ Dangerous: Password in token (tokens can be decoded!)
jwt.sign({ userId: 123, password: 'secret' }, key);

// ✅ Safe: Only IDs
jwt.sign({ userId: 123 }, key);

// eslint.config.js
import jwtPlugin from 'eslint-plugin-jwt';

export default [jwtPlugin.configs.recommended];

src/auth.ts
  15:3  error  🔒 CWE-347 CVSS:9.8 | JWT algorithm 'none' is allowed
               Risk: Attackers can forge tokens without a signature
               Fix: Remove 'none' from algorithms: ['HS256']