Study. uk . com
  1. Home
  2. All questions
  3. Question 357

CISSP study material · question 357 of 500

A library accepts a JSON web token whose algorithm header is set to none. Under RFC 7519, what is such a token and when is it intended to be used?

  1. A malformed token that must always be rejected by any implementation.
  2. An unsecured token, intended only where something outside the token secures its content.
  3. A token secured by transport encryption rather than by a signature.
  4. A token secured by an implicit default algorithm agreed between issuer and audience.
Show the answer

Answer: B. An unsecured token, intended only where something outside the token secures its content.

An unsecured token is a signature structure using the algorithm header value none with an empty signature, supported for cases where the content is secured by means outside the token.

Source: RFC 7519 (IETF) — RFC 7519 > 6. Unsecured JWTs

Challenge yourself on this topic → Study as cards