alt Hacker NewsThey did verify the signature, and it was correct according to the "none" algorithm.
Replies
alex_suzuki • today at 4:55 PM
“Works as designed.”
They did verify the signature, and it was correct according to the "none" algorithm.
“Works as designed.”
Argh, I missed that it actually uses the "none" algorithm. Yeah, the existence of that option is extremely dumb and it shouldn't be possible to use that. I misread the post and thought it was a regular JWT, but they simply didn't validate it.