OWASP Vulnerabilities · interview question
In the context of JWTs, what is the risk of not validating the 'alg' field in the header?
Multiple choiceHardchapter-17-curatedpremiumowasp-vulnerabilitiessql-injection
Answer and explanation
Correct answer
B. An attacker can use a weak algorithm to forge tokens
Why
Not validating the 'alg' field allows attackers to specify weaker algorithms, potentially forging tokens by computing a signature that matches the server's public key, compromising the token's integrity.
Test yourself on OWASP Vulnerabilities
A free test with instant, explained results. No account needed.
More OWASP Vulnerabilities questions
- How would you explain a potential consequence of not using prepared statements in SQL queries in an interview?
- Why is it important to validate the 'exp' claim in a JWT?
- How does the Spring Security filter chain protect against SQL Injection?
- How would you explain a potential risk of not using CSRF tokens in web applications in an interview?
- What does 'stateless' imply in the context of JWT?
- How would you explain a critical step in preventing stored XSS attacks in a Java-based web application in an interview?