Skip to main content

Home Articles npm Scorecard

Build Securely.

Engineering Leader & Open Source Creator. Architect of the Interlace ESLint Ecosystem.

GitHub
Dev.to
LinkedIn
X

© 2026 Ofri Peretz. All rights reserved.

Articles

Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.

Filtered by tag #jwt · clear filter

Jan 2, 2026
jsonwebtoken Will Verify a Token Signed With algorithm: none. These 13 ESLint Rules Stop It.
alg:none token forgery, RS256↔HS256 confusion, weak/hardcoded secrets, missing exp/iss/aud — the JWT auth mistakes that hand attackers a valid session. 13 CWE-mapped ESLint rules that catch them in CI.
#eslint#jwt#security+1
9 min
Dec 31, 2025
The JWT alg:none Attack: Change One Header Field, Forge an Admin Token. One ESLint Rule Blocks It.
alg:none tells a JWT verifier 'this token has no signature' — and a permissive verify call accepts the forgery. The header-swap walkthrough, why jsonwebtoken still ships the foot-gun, and the CWE-347 ESLint rule that fails the build on it.
#eslint#security#jwt+1
5 min