# JWT RS256公钥被用作HMAC密钥导致令牌伪造

- **ID:** `security/jwt-rs256-public-key-as-hmac-secret`
- **领域:** security
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

JWT库在服务器未对'alg'头进行白名单验证时，将公钥用作HS256对称密钥，使攻击者可以伪造令牌。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| jsonwebtoken 8.5.1 | active | — | — |
| PyJWT 2.4.0 | active | — | — |
| jjwt 0.9.1 | active | — | — |

## 解决方案

1. ```
   Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
   ```
2. ```
   Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'
   ```
3. ```
   Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False
   ```

## 无效尝试

- **** — Removes integrity checks entirely, making all tokens forgeable. (95% 失败率)
- **** — Does not restrict the algorithm whitelist; attacker can still switch to HS256. (80% 失败率)
- **** — Issuer verification does not prevent algorithm confusion; token header can be modified. (70% 失败率)