4 ms·
> The question is that why use and support 'alg:none' in the standard in the first place? FTFA: > The JWT standard supports insecure JWT algorithms for scenar
by wereHamster 7y ago
> The question is that why use and support 'alg:none' in the standard in the first place?
FTFA:
> The JWT standard supports insecure JWT algorithms for scenarios where encryption and a signature are not suitable, such as trusted server-to-server communication. In these scenarios, the none algorithm is specified in the JWT header. The none alg type should never be used for untrusted user-supplied tokens.
- jaywalk 7y agoIt's funny that they say it's "not suitable" when it's really just pure laziness. It takes two seconds to create a secret key and use the HS256 algorithm to generate and verify a signature.
- kelnos 7y agoCreating a key is easy; storing it securely and giving access to only the parts of your system that need it takes a bit more work. Of course, if you trust your network and the parties involved well enough that you'd be fine with unencrypted and unauthenticated data, I guess it doesn't matter if you just check the key into a git repo somewhere... but then you're potentially normalizing bad practices, even if in that particular instance it might be ok.
- different_sort 7y ago"trusted server"