JWT validation covers signature, algorithm, expiry, and audience

JWT algorithm confusion is one of the most exploited vulnerabilities in token-based auth. CWE-347 (Improper Verification of Cryptographic Signature) and CWE-290 (Authentication Bypass by Spoofing) describe how accepting alg: 'none' or failing to whitelist algorithms lets an attacker forge arbitrary tokens without the signing key. OWASP A07 (Identification & Authentication Failures) and NIST 800-53 IA-8 require integrity verification of authentication tokens. An RS256 public key misused as an HS256 secret is a textbook attack that compromises every user account on the system. Missing audience validation allows tokens issued for one service to be replayed against another.

Use the jose library and always specify the exact allowed algorithm. Never allow 'none':

import { jwtVerify, SignJWT } from 'jose'

const secret = new TextEncoder().encode(process.env.JWT_SECRET)

// Signing
const token = await new SignJWT({ userId: user.id })
  .setProtectedHeader({ alg: 'HS256' })
  .setIssuedAt()
  .setExpirationTime('15m')
  .setIssuer('https://yourapp.com')
  .setAudience('https://yourapp.com/api')
  .sign(secret)

// Verification — rejects wrong alg, expired tokens, wrong iss/aud
const { payload } = await jwtVerify(token, secret, {
  algorithms: ['HS256'],
  issuer: 'https://yourapp.com',
  audience: 'https://yourapp.com/api',
})

Never pass an untrusted alg claim from the token header to your verification function.