# JWT-001: Algorithm None Vulnerability
#
# JWT verification allowing algorithm "none", which accepts unsigned tokens.
# This is a critical vulnerability allowing token forgery.

[metadata]
id = "jwt-001"
name = "JWT allows algorithm none"
category = "jwt"
language = "javascript"
difficulty = "easy"
source = "hand-curated"
created = "2025-02-05"
notes = "Classic JWT vulnerability - CVE references available"

[input]
filename = "auth.js"
content = """
const jwt = require('jsonwebtoken');

function verifyToken(token) {
    // Flexible algorithm support for different clients
    const options = {
        algorithms: ['HS256', 'RS256', 'none']
    };
    return jwt.verify(token, process.env.JWT_SECRET, options);
}
"""

[expected]
must_contain = [
    { subject = "jwt/algorithms", predicate = "allows_none", value = true, rationale = "algorithms array includes 'none'" },
    { subject = "jwt/signature", predicate = "required", value = false, rationale = "Algorithm none means signatures are not required" }
]

must_not_contain = [
    { subject = "jwt/signature", predicate = "required", value = true, rationale = "Should not claim signatures are required when none is allowed" }
]

# Valid findings that LLM may extract but are not required
acceptable_variants = [
    { subject = "jwt/verification", predicate = "strict", value = false, rationale = "LLM may infer strict=false from none algorithm - valid but not primary finding" }
]

[scoring]
weight = 1.5
min_confidence = 0.85
