`jwt_algorithm_confusion`

CWE-347

Jwt Algorithm Confusion — a PullGuard finding type. Findings of this type appear in the PR comment, Step Summary, SARIF (GitHub Security tab / IDE viewers), and the HTML report, each with severity, location, and the remediation guidance below.

How to fix

Always pass algorithms explicitly to jwt.verify / jwt.decode trivial effort

// JS/TS — jsonwebtoken
jwt.verify(token, publicKey, { algorithms: ["RS256"] });

// Python — PyJWT
jwt.decode(token, public_key, algorithms=["RS256"])

// Java — jjwt
Jwts.parserBuilder().setSigningKey(publicKey).build().parseClaimsJws(token);

Never trust jwt.decode() in auth paths — it does NOT verify signature low effort

// WRONG — accepts forged tokens
const { userId } = jwt.decode(token);

// RIGHT — verifies signature + algorithm
const { userId } = jwt.verify(token, key, { algorithms: ["RS256"] });

Triage

Suppress a confirmed non-issue with a committed .pullguardignore entry (pullguard ignore locally, or comment /pullguard ignore <fingerprint> <reason> on the PR — the fingerprint is printed in the PR comment’s Triage section). Entries support expiresAt for time-boxed snoozes.

Security findings at major or critical severity — and any critical finding — always surface: .pullguardignore cannot hide them. The reviewed paths that keep them visible are acknowledged (reviewed, stays in reports) and, for a confirmed false positive, a reasoned false_positive entry — visible and audited, excluded only from the merge block.