HIGH AI PREVALENCE: MEDIUM auth.java.jwt.none-algorithm

A JWT is created or verified with the `none` algorithm, which means there is no signature at all.

CWE-347 OWASP API2:2023 java

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

An alg=none token can be forged by anyone. Changing the subject, roles, or expiry costs nothing because there is no signature to verify (CWE-347). This is a common AI-generated mistake: the "no signature" algorithm is reached for during prototyping or testing and never swapped for a real signing key.

Always sign and verify with a real algorithm. With jjwt use Jwts.builder()...signWith(key) and a keyed parser; with Auth0 java-jwt use Algorithm.HMAC256(secret) / Algorithm.RSA256(...) instead of Algorithm.none().

VULNERABLE

vulnerable.java

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

class TokenFactory {

    // jjwt: building a token with the unsecured NONE algorithm.
    String jjwtNone(String subject) {
        // ruleid: auth.java.jwt.none-algorithm
        return Jwts.builder().setSubject(subject).signWith(SignatureAlgorithm.NONE, "").compact();
    }

    // Auth0 java-jwt: the none() algorithm factory.
    String auth0None(String subject) {
        // ruleid: auth.java.jwt.none-algorithm
        Algorithm algorithm = Algorithm.none();
        return JWT.create().withSubject(subject).sign(algorithm);
    }
}

SAFE

safe.java

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import javax.crypto.SecretKey;

class TokenFactory {

    // jjwt: a real HMAC signing algorithm.
    String jjwtSigned(String subject, SecretKey key) {
        // ok: auth.java.jwt.none-algorithm
        return Jwts.builder().setSubject(subject).signWith(key, SignatureAlgorithm.HS256).compact();
    }

    // Auth0 java-jwt: HMAC256 with a real secret.
    String auth0Signed(String subject, String secret) {
        // ok: auth.java.jwt.none-algorithm
        Algorithm algorithm = Algorithm.HMAC256(secret);
        return JWT.create().withSubject(subject).sign(algorithm);
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.jwt.none-algorithm -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc8725#section-2.1 ↗https://cwe.mitre.org/data/definitions/347.html ↗

A JWT is created or verified with the none algorithm, which means there is no signature at all.

Why this matters

Suppressing this rule

References

A JWT is created or verified with the `none` algorithm, which means there is no signature at all.