thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

JWT None Algorithm

A JSON Web Token flaw where a library accepts tokens whose header specifies alg 'none', meaning no signature, allowing forged tokens.

Definition

Libraries must reject unsigned tokens and enforce an expected algorithm on the server side rather than trusting the token header. This is one of the best-known JWT implementation errors.

Example

A forged token with {"alg":"none"} and role admin is accepted by a misconfigured API.

Exam tip

Always pin the expected algorithm server-side.

Related terms