alt Hacker NewsSomeone not verifying the signature at all is not a mistake where you can blame the JWT spec itself.
Replies
buckle8017 • today at 4:25 PM
JWT is complicated.
Complexity is a spec failure in security issues.
It's that simple.
Someone not verifying the signature at all is not a mistake where you can blame the JWT spec itself.
JWT is complicated.
Complexity is a spec failure in security issues.
It's that simple.
They did verify the signature, and it was correct according to the "none" algorithm.