Skip to content

feat: adding support for Unsecured JWT without signature algorithm type "none" - #537

Closed
douggynix wants to merge 1 commit into
Keats:masterfrom
douggynix:feature/adding-none-algorithm-type
Closed

feat: adding support for Unsecured JWT without signature algorithm type "none"#537
douggynix wants to merge 1 commit into
Keats:masterfrom
douggynix:feature/adding-none-algorithm-type

Conversation

@douggynix

Copy link
Copy Markdown

Unsecure JWTs Decoding

Here I add support for decoding JWT with header algorithm set to value "none". The RFC has it specified. But JSONWeb token library didn't support decoding such JWT and would always fail. I added None to the list of variants of Algorithm enums to be able to support unsecure jwt decoding.

Here is the RFC and the section of the pages where this is mentioned as a spec to JWT which jsonwebtoken lib didn't support.
https://datatracker.ietf.org/doc/html/rfc7519#page-12
image

…pe "none"

feat: rename None for Serialization

feat: adding none as algorithm variant type for Unsecured JWT
@Keats

Keats commented Sep 10, 2026

Copy link
Copy Markdown
Owner

It's not supported on purpose. Use https://docs.rs/jsonwebtoken/latest/jsonwebtoken/dangerous/fn.insecure_decode.html if you need to handle the "none" case.

@Keats Keats closed this Sep 10, 2026
@douggynix

douggynix commented Sep 10, 2026

Copy link
Copy Markdown
Author

It's not supported on purpose. Use https://docs.rs/jsonwebtoken/latest/jsonwebtoken/dangerous/fn.insecure_decode.html if you need to handle the "none" case.

It is still an issue. The issue is with insecure_decode. The serializer always failed when the header field has alg with value none as below

{
  "alg": "none",
  "typ": "JWT"
}

Even though you skip validations for with insecure_decode functions, the deserialization is always failing as the enum you use for Algorithm values doesn't have "none" in its list . I guess you may reconsider reopen up this PR as this is a real issue.
For a simple test try to decode that legit Unsecure JWT with header type alg = none as below.
Here is one example to try out. I even have a unit test case from this PR to handle particularly that case: I am going to open up an issue for a more understanding of the deserialization problem

    let token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2huQGVtYWlsLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxNTE2MjM5MDQwLCJhdWQiOlsianNvbndlYnRva2VudGVzdCJdfQ.";

    let TokenData { header, claims } = insecure_decode::<Claims>(token).unwrap();

    assert_eq!(Some("JWT".to_string()), header.typ);

    assert_eq!(vec!["jsonwebtokentest"], claims.aud);
    assert_eq!("john@email.com", claims.sub);
    assert_eq!(1516239022, claims.iat);
    assert_eq!(1516239040, claims.exp);

called Result::unwrap() on an Err value: Error(Json(Error("unknown variant none, expected one of HS256, HS384, HS512, ES256, ES384, RS256, RS384, RS512, PS256, PS384, PS512, EdDSA", line: 1, column: 13)))
stack backtrace:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants