Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Unable to verify token with alg: 'none'

See original GitHub issue

Attempting to verify a token with the alg header set to ‘none’ always fails. This is because the implementation of the NoneAlgorithm ‘verify’ unconditionally returns False.

    def verify(self, msg, key, sig):
        return False

Expected Result

Verifying any token with the alg header set to ‘none’ should always succeed whenever the token has a valid format.

Actual Result

Verifying the token fails.

Traceback (most recent call last):
  File "C:/Users/chili/PycharmProjects/untitled/jwtmaker.py", line 7, in <module>
    decoded = jwt.decode(encoded, None, algorithms=['none'])
  File "C:\Users\chili\PycharmProjects\untitled\venv\lib\site-packages\jwt\api_jwt.py", line 92, in decode
    jwt, key=key, algorithms=algorithms, options=options, **kwargs
  File "C:\Users\chili\PycharmProjects\untitled\venv\lib\site-packages\jwt\api_jws.py", line 156, in decode
    key, algorithms)
  File "C:\Users\chili\PycharmProjects\untitled\venv\lib\site-packages\jwt\api_jws.py", line 223, in _verify_signature
    raise InvalidSignatureError('Signature verification failed')
jwt.exceptions.InvalidSignatureError: Signature verification failed

Reproduction Steps

import jwt
encoded = jwt.encode({'some': 'payload'}, None, algorithm='none')
decoded = jwt.decode(encoded, None, algorithms=['none'])

System Information

$ python -m jwt.help

{
  "cryptography": {
    "version": "2.6.1"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.6.5"
  },
  "platform": {
    "release": "10",
    "system": "Windows"
  },
  "pyjwt": {
    "version": "1.7.1"
  }
}