Blog Post Sep 5, 2026
JWT Algorithm Confusion Explained: Forging Tokens with RS256 to HS256
Engineering
How JWT algorithm confusion works, why switching RS256 to HS256 lets an attacker sign their own tokens with a public key, and how to shut it down in your own code.