Why must a JWT verifier explicitly specify allowed algorithms?
Options
- For performance, so verification runs faster
- To block
alg: noneand algorithm confusion attacks (Correct option) - Because tokens expire after a time
- Algorithms are optional in JWT, so it is not needed
Answer
To block attacks like alg: none or algorithm confusion (RS256 vs HS256 using the public key as an HMAC secret)
Why
A JWT header says which algorithm signed it, but that header comes from the client, so an attacker controls it.
With alg: none, a weak library may accept a token without any signature. With 'algorithm confusion', the attacker signs with HS256 using your PUBLIC key as the secret, and a careless verifier accepts it.
Always pass the expected algorithms: jwt.decode(token, key, algorithms=["RS256"]), and check exp, aud and iss.
Remember
Pin the allowed JWT algorithms; never trust the token's header.