<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd"> <qhelp>

<overview>
<p>Applications decoding JSON Web Token (JWT) may be misconfigured due to the none algorithm.</p>
<p>The none algorithm is selected by calling the <code>verify()</code> function with a falsy value
instead of a cryptographic secret or key. The none algorithm disables the integrity enforcement of
a JWT payload and may allow a malicious actor to make any desired changes to a JWT payload leading
to critical security issues like privilege escalation.</p>

</overview>

<recommendation>
<p>Call to <code>verify()</code> functions should use a cryptographic secret or key to decode JWT payloads.</p>

</recommendation>

<example>
<p>In the example, the first case is signing an object with a secret and a HS256 algorithm. In the
second case, an empty string is provided, then an undefined value, and finally a false value. These
three misconfigured calls to <code>jwt.verify()</code> can cause vulnerabilities.</p>

<sample src="examples/JWTMissingSecretOrPublicKeyVerification.js" />

</example>

<references>
<li>Auth0 Blog: <a href="https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/#Meet-the--None--Algorithm">Meet the "None" Algorithm</a>.</li>

</references>
</qhelp>