The Unsigned Token

A JWT is three Base64URL parts: header.payload.signature. The header names the signing algorithm. A classic flaw: the server accepts "alg":"none" — meaning no signature is verified at all, so you can rewrite the payload and walk in as anyone.

Your session token

Here is the JWT this "app" issued you. Decode each part (Base64URL) and read it.

The header says {"alg":"none"}. That means no signature is checked. Re-encode the header and payload with the payload's role changed from user to admin, keep the trailing dot, and submit the forged token below. Tip: btoa(JSON.stringify(obj)) in the console, then make it URL-safe (+→-, /→_, drop =).

Present a token to the app

The "server" below verifies tokens the broken way (accepts alg:none). Forge an admin token and paste it here to reveal the flag — or, once it accepts you, the flag appears automatically.

Submit the flag

Why it matters: pin the accepted algorithm server-side and reject alg:none outright. Always verify the signature with a key the client never sees.