The JWT verifier below trusts whatever the *signature check* reports — but the JWT spec allows an alg: "none" header, meaning "this token has no signature at all". A misconfigured verifier treats an unsigned token's "signature check" as trivially passing, since there's nothing to verify.
The bug: an attacker can craft a token with header {"alg":"none"}, no signature, and any payload they want (e.g. {"role":"admin"}) — if the verifier doesn't explicitly reject alg: none, that forged token is accepted as valid. This is a real, famous JWT library vulnerability class, not a hypothetical.
Your task: fix solve(header, signatureValid) so it returns false whenever header.alg is 'none' (case-insensitively) — regardless of what signatureValid says. Otherwise, return signatureValid unchanged.
Sample tests