v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.jwt.alg-none

JWTs are being verified with the none algorithm in the allowed list.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

An attacker can forge any token by simply setting alg: none in the header and supplying no signature, because the verification routine will accept it.

Restrict algorithms to the ones you actually use, e.g. ["RS256"] or ["ES256"]. Never include "none" or "None" in production code paths.

RFC 7518 §3.6 explicitly warns: "Implementations SHOULD NOT support the 'none' algorithm in deployed systems."

VULNERABLE
vulnerable.ts
// ruleid: auth.jwt.alg-none
import jwt from 'jsonwebtoken';

export function badVerify(token: string) {
  return jwt.verify(token, 'k', { algorithms: ['RS256', 'none'] });
}

// ruleid: auth.jwt.alg-none
export function badVerify2(token: string) {
  return jwt.verify(token, 'k', { algorithms: ['none'] });
}

import { verify } from 'jsonwebtoken';
// ruleid: auth.jwt.alg-none -- destructured import
export function badVerifyDestructured(token: string) {
  return verify(token, 'k', { algorithms: ['none'] });
}
SAFE
safe.ts
import jwt from 'jsonwebtoken';

// ok: auth.jwt.alg-none
export function goodVerify(token: string) {
  return jwt.verify(token, process.env.JWT_PUBLIC_KEY!, { algorithms: ['RS256'] });
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.jwt.alg-none -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc7518#section-3.6 ↗https://owasp.org/www-project-api-security/ ↗