Algorithm Confusion Attack
An algorithm confusion attack exploits JWT libraries that trust the alg header to select verification mode. An attacker takes an RS256 token, changes alg to HS256, and signs using the RSA public key as the HMAC secret. If the verifier accepts HS256 with that key material, the forged token validates. This class of bugs has affected multiple frameworks and is listed in OWASP JWT guidance. Implementations across Node.js, Python, Go, Ruby, and Java follow the same RFC standards, so concepts transfer directly between stacks. Security reviews should treat this as part of your full authentication threat model, not an isolated configuration detail.
Why It Matters
Prevent confusion by hardcoding allowed algorithms in verify(), never mixing public keys into HMAC verification paths, and disabling alg:none. Security audits should include malicious alg header test cases. Treat algorithm pinning as mandatory, not optional hardening. Getting this wrong often surfaces only after an incident, when forged or replayed tokens expose gaps in validation or secret handling. Platform teams should encode these rules in libraries, linting, and deployment checklists so individual services cannot drift silently. Pair technical controls with monitoring: log verification failures, track unusual token lifetimes, and alert on spikes in 401 responses. Review this during every auth-related change, including framework upgrades, CDN additions, and new mobile or third-party clients.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Who is vulnerable?
Applications that let the token header choose verification algorithm without an allowlist, especially RS256 to HS256 swaps. Consult your JWT library documentation for exact option names, defaults, and error types. When in doubt, prefer stricter validation and shorter token lifetimes over permissive shortcuts.
How do I test for it?
Modify alg to HS256, sign with the published RSA public key as HMAC secret, and confirm verification rejects the token. Consult your JWT library documentation for exact option names, defaults, and error types. When in doubt, prefer stricter validation and shorter token lifetimes over permissive shortcuts.
Does ES256 have confusion variants?
Similar issues can arise when algorithms are loosely validated. Pin all expected asymmetric and symmetric algorithms explicitly. Consult your JWT library documentation for exact option names, defaults, and error types. When in doubt, prefer stricter validation and shorter token lifetimes over permissive shortcuts.