hard20 pts · first answer countsjwtauthenticationweb-security

JWT algorithm confusion

Tokens are signed with RS256. The API verifies them with jwt.verify(token, publicKey) and lets the library use whatever alg the token header says. An attacker forges tokens by signing with HS256 using the public key as the HMAC secret. What is the correct fix?

A.Keep the public key secret and rotate it often, so attackers can never get hold of itB.Pin the accepted algorithms on verify, e.g. { algorithms: ["RS256"] }C.Reject tokens longer than 1 KBD.Switch the whole system to HS256

Discussion 0

Join free to post in the discussion.

JWT algorithm confusion

Discussion 0

Related questions