Thread

1. rdtsc · 1790785405 · focus · HN ↗

   > {"alg":"none","typ":"JWT"}

   I don't know how this ever became a thing that was allowed into the spec and then picked from the spec and implemented in various implementations.

   1. flowerlad · 1790789214 · focus · HN ↗

      It should be retroactively removed the spec, and all implementations should remove the "none" algorithm. It is a huge security hole.
   2. pixl97 · 1790789851 · focus · HN ↗

      Yea, and it was a big issue years ago. I can't believe there is any modern implementation that has it.... or another way to put this is, how old is this damned implementation they are using?
   3. huflungdung · 1790794937 · focus · HN ↗

      [dead]

Unofficial Hacker News client; not affiliated with Y Combinator.