v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.py.jwt.alg-none

A JWT is decoded or signed with the none algorithm.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

The none algorithm means the token is NOT cryptographically signed, so any attacker can forge a token with arbitrary claims and have it accepted, a complete authentication bypass (CVE-class JWT alg=none vulnerability).

Never allow none. Pin a strong signing algorithm explicitly: jwt.decode(token, key, algorithms=["RS256"]) for verification, or jwt.encode(claims, key, algorithm="RS256") (also ES256 / HS256) when issuing tokens. Never include "none" in the algorithms allowlist.

VULNERABLE
vulnerable.py
import jwt


def decode_none(token: str, key: str):
    # ruleid: auth.py.jwt.alg-none
    return jwt.decode(token, key, algorithms=["none"])


def decode_none_case(token: str, key: str):
    # ruleid: auth.py.jwt.alg-none
    return jwt.decode(token, key, algorithms=["RS256", "None"])


def decode_none_upper(token: str, key: str):
    # ruleid: auth.py.jwt.alg-none
    return jwt.decode(token, key, algorithms=["NONE"])


def encode_none(claims: dict, key: str):
    # ruleid: auth.py.jwt.alg-none
    return jwt.encode(claims, key, algorithm="none")
SAFE
safe.py
import jwt


def decode_rs256(token: str, key: str):
    # ok: auth.py.jwt.alg-none
    return jwt.decode(token, key, algorithms=["RS256"])


def decode_multiple_strong(token: str, key: str):
    # ok: auth.py.jwt.alg-none
    return jwt.decode(token, key, algorithms=["RS256", "ES256"])


def encode_hs256(claims: dict, key: str):
    # ok: auth.py.jwt.alg-none
    return jwt.encode(claims, key, algorithm="HS256")

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.jwt.alg-none -- <reason>

References

https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode ↗https://cwe.mitre.org/data/definitions/347.html ↗