Python : Weak JWT signature algorithm

The application uses a weak signature algorithm.

Obsolete signature algorithms do not provide sufficient protection for applications that work with sensitive data. The security of a signature algorithm is determined by the estimated time and resources required to obtain the key used to generate the signature. The development of new attack methods and the increase in computing power of computers lead to the obsolescence of algorithms previously considered secure. For example, HS256 is vulnerable to a brute-force attack with a medium key length.

Tested implementations of standardized signature algorithms with sufficient key length should be used to protect valuable data.

Sensitive Data Exposure vulnerabilities rank third in the OWASP Top 10 2017 web application vulnerability ranking.