HardPro challengeJavaScriptTypeScript

JWT "none" Algorithm — Reject Unsigned Tokens

JavaScriptSecurityBroken Authentication

The JWT verifier below trusts whatever the *signature check* reports — but the JWT spec allows an alg: "none" header, meaning "this token has no signature at all". A misconfigured verifier treats an unsigned token's "signature check" as trivially passing, since there's nothing to verify.

The bug: an attacker can craft a token with header {"alg":"none"}, no signature, and any payload they want (e.g. {"role":"admin"}) — if the verifier doesn't explicitly reject alg: none, that forged token is accepted as valid. This is a real, famous JWT library vulnerability class, not a hypothetical.

Your task: fix solve(header, signatureValid) so it returns false whenever header.alg is 'none' (case-insensitively) — regardless of what signatureValid says. Otherwise, return signatureValid unchanged.

Sample tests

Test #1Valid signed token accepted
Input: [{"alg":"HS256"},true]
Output: true
Test #2Invalid signature rejected
Input: [{"alg":"HS256"},false]
Output: false
Test #3CRITICAL: unsigned "none" token rejected even though signatureValid is true
Input: [{"alg":"none"},true]
Output: false