alt Hacker News> {"alg":"none","typ":"JWT"}
I don't know how this ever became a thing that was allowed into the spec and then picked from the spec and implemented in various implementations.
Replies
flowerlad • today at 5:26 PM
It should be retroactively removed the spec, and all implementations should remove the "none" algorithm. It is a huge security hole.
huflungdung • today at 7:02 PM
[dead]
Yea, and it was a big issue years ago. I can't believe there is any modern implementation that has it.... or another way to put this is, how old is this damned implementation they are using?