JWT no validation (ARCH3126)

Key typescript.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Decoding a JWT without verifying its signature (decode, verify=false, alg: none) lets attackers freely tamper with token contents. Always verify the signature with the expected algorithm.

Incorrect

import jwt from "jsonwebtoken";

const payload = jwt.decode(token) as { sub: string };
const user = await findUser(payload.sub);

Correct

import jwt from "jsonwebtoken";

const payload = jwt.verify(token, publicKey, {
  algorithms: ["RS256"],
}) as { sub: string };
const user = await findUser(payload.sub);

Fix

Use verify instead of decode; specify allowed algorithms explicitly and never permit none.