Python : JWT: None Algorithm

A JWT token is a string consisting of three parts, each of which is encoded using base64: headline, payload and signature. The base64 encoding does not encrypt or protect the data, but only represents it in an ASCII character sequence. In the first part - token header - the signature algorithm is specified. The algorithm may not exist. The none algorithm may cause the application to be compromised.

This algorithm is used when the integrity of the token is already verified. Some libraries perceive tokens with an algorithm such as validated tokens. An attacker can create “signed” tokens and add any payload. This will allow for random access to the account on the system and, as a result, compromise the application.