Hardening APIs Against JWT Algorithm Confusion

JSON Web Tokens (JWT) are widely adopted for access authorization. However, a severe JWT vulnerability known as Algorithm Confusion permits attackers to forge administrative tokens.

---

The Mechanic of Algorithm Confusion

This attack targets services that accept both asymmetric (e.g., RS256) and symmetric (e.g., HS256) algorithms.

• The server issues tokens signed via RS256, verifying signatures with its public key.
• The public key is easily accessible via JWKS endpoints.
• An attacker tampers with the token header: "alg": "HS256".
• The attacker signs the forged payload using the public key as the HS256 secret.
• The server verifies the token. Since it uses HS256, it treats the public key string as the HMAC secret, validates the signature, and accepts the forged claims.

---

Remediation & Hardening

• Enforce Strict Verification Parameters: Always specify the expected algorithm inside verification library calls:

// Node/TypeScript Hardened verification
jwt.verify(token, publicKey, { algorithms: ['RS256'] });

• Enforce Key Separation: Never accept symmetric tokens if the microservice utilizes public-key infrastructure (PKI) signatures.