Test for weak HMAC keys, 'alg': 'none' authentication bypasses, and unverified token signature flaws.
Examines token headers, expiration enforcement (exp claim), symmetric key confusion attacks, and brute-forces short signing secrets.
Canonical test payload dispatched during security surface audits.
{"alg": "none", "typ": "JWT"}.{"role": "admin"}.Watch the probe engine test this signature in an isolated sandbox.
Strict Algorithm Enforcement
jwt.verify(token, secret);
jwt.verify(token, secret, { algorithms: ['HS256'] });Explicitly restrict accepted JWT algorithms to prevent algorithm downgrade attacks like 'none'.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for JWT Security & Algorithm Scanner.
Checks commonly evaluated alongside JWT Security & Algorithm Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.