JWT alg=none

web · hard · 350 pts

Acme's auth API issues HS256 JWTs but the server's validation function trusts the alg field. Endpoints: GET / (lists endpoints), POST /login, GET /me, GET /admin Map your team's instance to: AYSEC-106 M07 (API Security). --- ### Run locally ```bash cd content/aysec/AYSEC-CTF docker compose up jwt-none ``` Then open `http://localhost:8000` and start solving.