{CodeRoyale}
All challenges
Multiple ChoiceIntermediate 30s

JWT: alg=none / key confusion

Which JWT flaw lets an attacker forge tokens when the server trusts the header 'alg'?
Options
  1. 1A missing exp claim that lets tokens stay forever valid with no expiry checking
  2. 2Algorithm confusion (RS256 verified as HS256 with the public key as HMAC secret)
  3. 3An oversized payload that overflows the parser buffer during decoding of the token
  4. 4Non-canonical base64 padding that bypasses verification and lets the signature pass
cybersecmcqintermediate

Think you can answer under pressure?

Get matched and answer live questions in 3-minute 1v1 battles. Elo ranking, badge tiers and bragging rights on the line.

Play this in a 3-minute battle