hard20 pts · first answer countssecurity-fundamentalscryptographyauthentication
JWT signed with the public key
An API verifies RS256 JWTs, but its library picks the algorithm from the token header. An attacker sends a token with alg: HS256, signed using the server's RSA public key as the HMAC secret. Why can this work?
Discussion 0
Join free to post in the discussion.
Related questions
- Which part of the CIA triad does a DDoS hit?Cybersecurity Analyst
- Threat, vulnerability or risk?Cybersecurity Analyst
- What does SHA-256 do?Cybersecurity Analyst
- Symmetric or asymmetric?Cybersecurity Analyst
- Applying least privilegeCybersecurity Analyst
- Which key encrypts a secret message?Cybersecurity Analyst
- How a digital signature is createdCybersecurity Analyst
- Why passwords are saltedCybersecurity Analyst