How to fix JWT Vulnerabilities (Weak Signing, None Algo)
in ASP.NET Core
Executive Summary
JWT implementation in ASP.NET Core is often a house of cards. Misconfigured 'TokenValidationParameters' allow attackers to bypass authentication using the 'none' algorithm or brute-forcing weak HMAC keys. As a Senior AppSec Researcher, I've seen these patterns lead to full account takeovers. Here is how you lock down your middleware.
The Vulnerable Pattern
services.AddAuthentication().AddJwtBearer(options => {
options.TokenValidationParameters = new TokenValidationParameters {
ValidateIssuerSigningKey = false, // CRITICAL: Disables signature verification
SignatureValidator = delegate (string token, TokenValidationParameters parameters) {
return new JwtSecurityToken(token); // CRITICAL: Returns token without checking signature
},
ValidateIssuer = false,
ValidateAudience = false,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("weak-key")) // CRITICAL: Brute-forceable key
};
});The Secure Implementation
The vulnerability stems from two main vectors: Algorithm Confusion and Weak Key Entropy. In the vulnerable snippet, 'ValidateIssuerSigningKey = false' or a custom 'SignatureValidator' that skips logic allows an attacker to change the header to '{"alg":"none"}' and provide no signature, which the server accepts as valid. The fix requires: 1. Setting 'ValidateIssuerSigningKey' to true. 2. Using 'ValidAlgorithms' to explicitly allow only 'HS256' (or your chosen strong algo), which hard-blocks 'none' at the library level. 3. Ensuring your 'IssuerSigningKey' is at least 256-bits (32+ characters) and stored in a secure configuration/vault, preventing offline brute-force attacks using tools like Hashcat.
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options => {
options.TokenValidationParameters = new TokenValidationParameters {
ValidateIssuerSigningKey = true,
RequireSignedTokens = true,
// Explicitly whitelist strong algorithms to prevent 'none' or 'HS256' vs 'RS256' confusion
ValidAlgorithms = new[] { SecurityAlgorithms.HmacSha256 },
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:SecretKey"])),
ValidateIssuer = true,
ValidIssuer = builder.Configuration["Jwt:Issuer"],
ValidateAudience = true,
ValidAudience = builder.Configuration["Jwt:Audience"],
ClockSkew = TimeSpan.Zero
};
});
Your ASP.NET Core API
might be exposed to JWT Vulnerabilities (Weak Signing, None Algo)
74% of ASP.NET Core apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.