alg:none is a JWS algorithm identifier meaning that no digital signature or message authentication code is applied. If a verifier accepts it, an attacker can alter the header and payload while bypassing signature validation. section 11.4.2
A production failure mode
An attacker could intercept a JWS, change its alg field to none, modify the payload, and forward the request. The United Kingdom’s NHS COVID-19 Android contact-tracing app was reported affected in October 2020. section 11.4.2
Avoid the vulnerability by:
- Rejecting alg:none explicitly in JWS or JWT library configuration. section 11.4.2
- Parsing the compact JWS, verifying it with the expected secret or key, and treating exceptions or failed verification as invalid. section 11.4.2
Listing 11.3 Verifying a JWS object using Nimbus
public final class JwsUtil {
private static final byte[] HMAC_SECRET =
Base64.getDecoder().decode(
"VGhpc0lzQS1EZW1vLVNlY3JldC1LZXktR
➥m9yLUhTMjU2LUF0TGVhc3QtMzJCeXRlcyE="
);
public static boolean verifyJws(String compactJws) {
try {
JWSObject parsed = JWSObject.parse(compactJws); #1
return parsed.verify(new MACVerifier(HMAC_SECRET)); #2
} catch (ParseException | JOSEException e) {
return false;
}
}
}
Nimbus verification parses the JWS and checks it with MACVerifier; its verifier rejects alg:none rather than accepting an unsigned token. section 11.4.2
