Rules
All ESLint security rules provided by eslint-plugin-jwt
13 Security Rules
Comprehensive coverage of JWT security including algorithm confusion, token validation, and CVE-specific vulnerabilities.
All Rules
| Rule | 💼 | 🔧 | 💡 | ⚠️ | Docs |
|---|---|---|---|---|---|
| no-algorithm-confusion This rule detects algorithm confusion attacks where symmetric algorithms (HS256, HS384, HS512) are used with asymmetr... | |||||
| no-algorithm-none This rule detects attempts to use the none algorithm which completely bypasses JWT signature verification | |||||
| no-decode-without-verify The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | |||||
| no-hardcoded-secret The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | |||||
| no-sensitive-payload JWT payloads are NOT encrypted, only base64-encoded | |||||
| no-timestamp-manipulation This rule detects noTimestamp: true which disables automatic iat (issued at) claim generation | |||||
| no-weak-secret The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | |||||
| require-algorithm-whitelist This rule enforces explicit algorithm specification in verify() calls | |||||
| require-audience-validation The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | |||||
| require-expiration The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | |||||
| require-issued-at This rule ensures tokens have the iat claim for freshness validation | |||||
| require-issuer-validation The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | |||||
| require-max-age This rule mandates maxAge in verify operations |
Rule Categories
Algorithm Security
Rules preventing algorithm confusion attacks (CVE-2022-23540) and ensuring proper algorithm whitelisting.
Token Validation
Rules requiring proper validation of audience, issuer, expiration, and issued-at claims.
Secrets & Keys
Rules detecting hardcoded secrets and weak signing keys.
Payload Security
Rules preventing sensitive data exposure in JWT payloads.