A JWT is encoded or decoded with the none algorithm, which produces (and accepts) unsigned tokens.

Why this matters

Anyone can craft a token with any claims and it will be trusted, because there is no signature to verify (CWE-347). This shows up in AI-generated "quick token" and debugging code that then ships.

Sign with a real algorithm and a key from configuration: JWT.encode(payload, ENV.fetch('JWT_SECRET'), 'HS256') JWT.decode(token, key, true, { algorithm: 'HS256' })

require 'jwt'

def issue(payload)
  # ruleid: auth.ruby.jwt.algorithm-none
  JWT.encode(payload, nil, 'none')
end

def check(token)
  # ruleid: auth.ruby.jwt.algorithm-none
  JWT.decode(token, nil, true, { algorithm: 'none' })
end

def check_list(token)
  # ruleid: auth.ruby.jwt.algorithm-none
  JWT.decode(token, nil, true, algorithms: ['none', 'HS256'])
end

require 'jwt'

def issue(payload)
  # ok: signed with a real algorithm and a key from the environment
  JWT.encode(payload, ENV.fetch('JWT_SECRET'), 'HS256')
end

def check(token)
  # ok: real algorithm pinned
  JWT.decode(token, ENV.fetch('JWT_SECRET'), true, { algorithm: 'HS256' })
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.jwt.algorithm-none -- <reason>

References