# JWT RS256 public key used as HMAC secret allows token forgery

- **ID:** `security/jwt-rs256-public-key-as-hmac-secret`
- **Domain:** security
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

The JWT library uses the public key as a symmetric secret for HS256 when the server trusts the 'alg' header without validating against a whitelist, enabling attackers to forge tokens.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| jsonwebtoken 8.5.1 | active | — | — |
| PyJWT 2.4.0 | active | — | — |
| jjwt 0.9.1 | active | — | — |

## Workarounds

1. **Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })** (95% success)
   ```
   Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
   ```
2. **Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'** (90% success)
   ```
   Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'
   ```
3. **Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False** (85% success)
   ```
   Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False
   ```

## Dead Ends

- **** — Removes integrity checks entirely, making all tokens forgeable. (95% fail)
- **** — Does not restrict the algorithm whitelist; attacker can still switch to HS256. (80% fail)
- **** — Issuer verification does not prevent algorithm confusion; token header can be modified. (70% fail)