alg=none and Signature Verify
Unverified JWT is fan fiction — break YOUR lab safely on 127.0.0.1:8813.
Visual · jwt_alg_none_verify
Reject alg=none; always verify. 127.0.0.1:8813.
If the server trusts the header’s alg without verifying, the attacker writes the payload.
Classic pitfall: accept alg=none or switch RS256 to HS256 with the public key as HMAC secret. The fix is boring and mandatory: use a vetted library, allowlist algorithms, verify signature, then read claims. Cyberlium teaches this on a vulnerable-by-lesson lab YOU own — not by attacking random SaaS. Dest 127.0.0.1:8813. Never use token forgeries against systems outside RoE. Never hydra signing keys on strangers. Next: Claims Hygiene.
1. alg=none is a history lesson with a still-sharp edge
Some stacks once treated a none algorithm as “unsigned is fine.” Unsigned tokens must not authorize. Your lab may demonstrate a wrong mode and a fixed mode — both on loopback.
Write: client-supplied alg is not a trust source; server allowlist is.
Command guide
Try these commands — alg=none is a history lesson with a still-sharp edge
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
JWT BCP RFC 8725 — https://datatracker.ietf.org/doc/html/rfc8725 OWASP JWT cheat sheet — https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install openssl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
openssl rand -base64 32 | head -c 44; echo ' # lab signing secret length example'
curl -sS -o /dev/null -w "alg=none attempt %{http_code}
" -H "Authorization: Bearer eyJhbGciOiJub25lIn0.eyJyb2xlIjoiYWRtaW4ifQ." http://127.0.0.1:8813/me
curl -sS -H "Authorization: Bearer lab-signed-jwt" http://127.0.0.1:8813/me 2>/dev/null | head -c 200Primary tools to practice this lesson: curl, openssl. Reference sites: JWT BCP RFC 8725 (https://datatracker.ietf.org/doc/html/rfc8725); OWASP JWT cheat sheet (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Verify before you trust claims
Order of operations: parse carefully → verify signature with expected key/alg → validate claims (exp, aud, iss). Skipping verify makes role=admin in the payload a self-serve promotion.
On YOUR lab, compare responses when verification is on vs intentionally off (teaching switch only).
3. Ethics wall for “JWT attacks”
Wordlist cracking HS256 secrets against production is unauthorized. Stick to lab secrets the course documents.
Ship a note: verify-on vs verify-off statuses from 127.0.0.1:8813.
4. What you ship: verify-on vs verify-off evidence on YOUR lab
Allowlist alg sentence. Demo of rejected unsigned/forged lab token when verify is on. Dest 127.0.0.1:8813. No stranger forging.
5. What you record before the next lesson
Date. Verify results. NEVER production forgery. File t13-m04-l02-alg-none-verify.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Forge admin JWTs for a public API. Crack classmate tokens. Enable alg=none in a real product “to debug.”
- Right: Lab verify evidence. Next: Claims Hygiene.
Mission: prove verify is mandatory
1) / STOP if router. 2) On 127.0.0.1:8813, show forged/unsigned rejected when verify is on. 3) Write alg allowlist rule. Never forge against unowned hosts.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor which library your stack uses to verify — not for a public target list.
APPLY: Server trusts alg=none tokens as authenticated. Verdict?
APPLY: True or False: You should forge JWTs against any site that uses JWT to “practice alg=none.”
APPLY: Correct order?