JWT No Validation (ARCH6126)

Key ruby.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Decoding a JWT without signature verification (verify: false or the none algorithm) lets attackers forge claims. Always verify the signature and algorithm.

Incorrect

require "jwt"

payload, = JWT.decode(token, nil, false)
user_id = payload["sub"]

Correct

require "jwt"

secret = ENV.fetch("JWT_SIGNING_KEY")
payload, = JWT.decode(token, secret, true, algorithm: "HS256")
user_id = payload["sub"]

Fix

Call JWT.decode with verify = true and an explicit algorithm; never skip the signature.