JWT Attacks: When the Verifier Trusts the Token Too Much

What it is#

A JWT's header names its own signing algorithm, and its payload carries whatever claims it wants, including, often, a role or permission level. Both attacks here come down to the same mistake: a verifier that trusts one of those two things instead of enforcing it independently.

The labs here#

• TicketFlow alg-none forgery: the verifier reads the algorithm from the token's own header and honours it, including the option to say "none." Set alg to none, drop the signature entirely, and edit the payload however you like. There's nothing left to check it against.
• SkyView RS256/HS256 key confusion: the server normally signs with RS256 (an RSA key pair: private to sign, public to verify), but the verifier also accepts HS256 (a single shared secret used for both). If the RSA public key is available to you (and it usually is, by design), you can use it as the HMAC secret and self-sign a token the server will treat as validly signed.