v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.go.jwt.none-algorithm

A JWT is created or accepted with the none algorithm, which produces an unsigned token.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

Anyone can forge such a token by setting alg: none and omitting the signature, so the server has no way to verify who issued it: a complete authentication bypass (CWE-347). In golang-jwt this happens when signing with jwt.SigningMethodNone or passing the jwt.UnsafeAllowNoneSignatureType sentinel to SignedString.

Never use the none algorithm. Sign tokens with a real algorithm such as HS256 (jwt.SigningMethodHS256), RS256 (jwt.SigningMethodRS256), or ES256 (jwt.SigningMethodES256) and verify them with the matching key.

VULNERABLE
vulnerable.go
package main

import (
	"github.com/golang-jwt/jwt/v5"
)

// Case 1: signing a token with the `none` method via NewWithClaims.
func signNone() *jwt.Token {
	// ruleid: auth.go.jwt.none-algorithm
	return jwt.NewWithClaims(jwt.SigningMethodNone, jwt.MapClaims{
		"sub": "1234567890",
	})
}

// Case 2: passing the UnsafeAllowNoneSignatureType sentinel to SignedString.
func signWithUnsafeSentinel(token *jwt.Token) (string, error) {
	// ruleid: auth.go.jwt.none-algorithm
	return token.SignedString(jwt.UnsafeAllowNoneSignatureType)
}

// Case 3: building a token with the none method via jwt.New.
func newNone() *jwt.Token {
	// ruleid: auth.go.jwt.none-algorithm
	return jwt.New(jwt.SigningMethodNone)
}
SAFE
safe.go
package main

import (
	"github.com/golang-jwt/jwt/v5"
)

// ok: auth.go.jwt.none-algorithm
func signHS256(secret []byte) (string, error) {
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
		"sub": "1234567890",
	})
	return token.SignedString([]byte(secret))
}

// ok: auth.go.jwt.none-algorithm
func signRS256(token *jwt.Token, key interface{}) (string, error) {
	token = jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
		"sub": "abc",
	})
	return token.SignedString(key)
}

// ok: auth.go.jwt.none-algorithm
func signES256(key interface{}) jwt.SigningMethod {
	return jwt.SigningMethodES256
}

// ok: auth.go.jwt.none-algorithm -- defensively REJECTING none is not a misuse
func rejectNone(token *jwt.Token) error {
	if token.Method == jwt.SigningMethodNone {
		return jwt.ErrTokenUnverifiable
	}
	return nil
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.jwt.none-algorithm -- <reason>

References

https://pkg.go.dev/github.com/golang-jwt/jwt/v5#pkg-variables ↗https://cwe.mitre.org/data/definitions/347.html ↗