JWT no algorithm

Description

We sent a token with the 'none' algorithm and it was accepted by the server. This means that we can handcraft any token to impersonate another user.

You must validate the algorithm used to sign the token before checking it's signature.

Identifier: injection/jwt_alg_none

{
    "checks": {
        "injection/jwt_alg_none": {
            "skip": true
        }
    }
}