> {"alg":"none","typ":"JWT"}I don't know how this ever became a thing that was allowed into the spec and then picked from the spec and implemented in various implementations.
It should be retroactively removed the spec, and all implementations should remove the "none" algorithm. It is a huge security hole.
rdtsc · · focus · HN ↗
I don't know how this ever became a thing that was allowed into the spec and then picked from the spec and implemented in various implementations.
flowerlad · · focus · HN ↗