web-token/jwt-unsecured

Unsecured JWS (the "none" algorithm) for the JWT Framework.

Maintainers

Package info

github.com/web-token/jwt-unsecured

Homepage

pkg:composer/web-token/jwt-unsecured

Transparency log

Statistics

Installs: 332

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

4.3.x-dev 2026-08-29 19:33 UTC

Requires

MIT 36e75e93d3142708e7c4291bfc927a0224121b5b

symfonybundlejwtJWSJWEJOSEjwaJWKJWKSetJotRFC7515RFC7516RFC7517RFC7518RFC7519RFC7520

Published on Packagist.org on 2026-08-30 14:18 UTC

This package is auto-updated.

Last update: 2026-08-30 14:19:17 UTC

README

This repository is a sub repository of the JWT Framework project and is READ ONLY.

Please do not submit any Pull Request here. You should go to the main repository instead.

What Is In This Package?

The none signature algorithm, used by the unsecured JWT of RFC 7519, section 6.

It is not an experimental algorithm: it is perfectly standard, but a JWS that uses it has no integrity protection at all, and it is the root cause of the JWT "alg confusion" family of vulnerabilities. It is shipped apart from the main library so that using it is an explicit and auditable decision: an application that does not require this package simply cannot be tricked into accepting an unsecured token.

Documentation

The official documentation is available as https://web-token.spomky-labs.com/

Licence

This software is release under MIT licence.