eslint-plugin-jwt-security 2.3.0

package/dist/src/index.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noSensitivePayload = exports.requireMaxAge = exports.noTimestampManipulation = exports.requireAudienceValidation = exports.requireIssuerValidation = exports.requireIssuedAt = exports.noHardcodedSecret = exports.requireExpiration = exports.noWeakSecret = exports.noDecodeWithoutVerify = exports.requireAlgorithmWhitelist = exports.noAlgorithmConfusion = exports.noAlgorithmNone = exports.configs = exports.plugin = exports.rules = void 0;
+// Import rules - Core Security
+const no_algorithm_none_1 = require("./rules/no-algorithm-none");
+Object.defineProperty(exports, "noAlgorithmNone", { enumerable: true, get: function () { return no_algorithm_none_1.noAlgorithmNone; } });
+const no_algorithm_confusion_1 = require("./rules/no-algorithm-confusion");
+Object.defineProperty(exports, "noAlgorithmConfusion", { enumerable: true, get: function () { return no_algorithm_confusion_1.noAlgorithmConfusion; } });
+const require_algorithm_whitelist_1 = require("./rules/require-algorithm-whitelist");
+Object.defineProperty(exports, "requireAlgorithmWhitelist", { enumerable: true, get: function () { return require_algorithm_whitelist_1.requireAlgorithmWhitelist; } });
+const no_decode_without_verify_1 = require("./rules/no-decode-without-verify");
+Object.defineProperty(exports, "noDecodeWithoutVerify", { enumerable: true, get: function () { return no_decode_without_verify_1.noDecodeWithoutVerify; } });
+const no_weak_secret_1 = require("./rules/no-weak-secret");
+Object.defineProperty(exports, "noWeakSecret", { enumerable: true, get: function () { return no_weak_secret_1.noWeakSecret; } });
+const require_expiration_1 = require("./rules/require-expiration");
+Object.defineProperty(exports, "requireExpiration", { enumerable: true, get: function () { return require_expiration_1.requireExpiration; } });
+const no_hardcoded_secret_1 = require("./rules/no-hardcoded-secret");
+Object.defineProperty(exports, "noHardcodedSecret", { enumerable: true, get: function () { return no_hardcoded_secret_1.noHardcodedSecret; } });
+// Import rules - 2025 Vulnerability Research
+const require_issued_at_1 = require("./rules/require-issued-at");
+Object.defineProperty(exports, "requireIssuedAt", { enumerable: true, get: function () { return require_issued_at_1.requireIssuedAt; } });
+const require_issuer_validation_1 = require("./rules/require-issuer-validation");
+Object.defineProperty(exports, "requireIssuerValidation", { enumerable: true, get: function () { return require_issuer_validation_1.requireIssuerValidation; } });
+const require_audience_validation_1 = require("./rules/require-audience-validation");
+Object.defineProperty(exports, "requireAudienceValidation", { enumerable: true, get: function () { return require_audience_validation_1.requireAudienceValidation; } });
+const no_timestamp_manipulation_1 = require("./rules/no-timestamp-manipulation");
+Object.defineProperty(exports, "noTimestampManipulation", { enumerable: true, get: function () { return no_timestamp_manipulation_1.noTimestampManipulation; } });
+const require_max_age_1 = require("./rules/require-max-age");
+Object.defineProperty(exports, "requireMaxAge", { enumerable: true, get: function () { return require_max_age_1.requireMaxAge; } });
+const no_sensitive_payload_1 = require("./rules/no-sensitive-payload");
+Object.defineProperty(exports, "noSensitivePayload", { enumerable: true, get: function () { return no_sensitive_payload_1.noSensitivePayload; } });
+/**
+ * Collection of all JWT security ESLint rules (13 rules)
+ */
+exports.rules = {
+    // Core Security Rules
+    'no-algorithm-none': no_algorithm_none_1.noAlgorithmNone,
+    'no-algorithm-confusion': no_algorithm_confusion_1.noAlgorithmConfusion,
+    'require-algorithm-whitelist': require_algorithm_whitelist_1.requireAlgorithmWhitelist,
+    'no-decode-without-verify': no_decode_without_verify_1.noDecodeWithoutVerify,
+    'no-weak-secret': no_weak_secret_1.noWeakSecret,
+    'require-expiration': require_expiration_1.requireExpiration,
+    'no-hardcoded-secret': no_hardcoded_secret_1.noHardcodedSecret,
+    // 2025 Vulnerability Research - "Back to the Future" & Replay Prevention
+    'require-issued-at': require_issued_at_1.requireIssuedAt,
+    'require-issuer-validation': require_issuer_validation_1.requireIssuerValidation,
+    'require-audience-validation': require_audience_validation_1.requireAudienceValidation,
+    'no-timestamp-manipulation': no_timestamp_manipulation_1.noTimestampManipulation,
+    'require-max-age': require_max_age_1.requireMaxAge,
+    'no-sensitive-payload': no_sensitive_payload_1.noSensitivePayload,
+};
+/**
+ * ESLint Plugin object
+ */
+exports.plugin = {
+    meta: {
+        name: 'eslint-plugin-jwt-security',
+        version: '2.2.9',
+    },
+    rules: exports.rules,
+};
+/**
+ * Recommended configuration - baseline security
+ * Critical rules as errors, high as warnings
+ */
+const recommendedRules = {
+    // CRITICAL - Algorithm attacks
+    'jwt/no-algorithm-none': 'error',
+    'jwt/no-algorithm-confusion': 'error',
+    // HIGH - Verification and secrets
+    'jwt/require-algorithm-whitelist': 'error',
+    'jwt/no-decode-without-verify': 'error',
+    'jwt/no-weak-secret': 'error',
+    'jwt/no-hardcoded-secret': 'error',
+    'jwt/no-timestamp-manipulation': 'error', // LightSEC 2025
+    // MEDIUM - Best practices
+    'jwt/require-expiration': 'error',
+    'jwt/no-sensitive-payload': 'warn',
+};
+/**
+ * Strict configuration - maximum security (2025 research)
+ * All rules as errors - includes replay attack prevention
+ */
+const strictRules = {
+    // All core rules as errors
+    'jwt/no-algorithm-none': 'error',
+    'jwt/no-algorithm-confusion': 'error',
+    'jwt/require-algorithm-whitelist': 'error',
+    'jwt/no-decode-without-verify': 'error',
+    'jwt/no-weak-secret': 'error',
+    'jwt/no-hardcoded-secret': 'error',
+    'jwt/require-expiration': 'error',
+    // 2025 Research - Full replay attack prevention
+    'jwt/require-issued-at': 'error',
+    'jwt/require-issuer-validation': 'error',
+    'jwt/require-audience-validation': 'error',
+    'jwt/no-timestamp-manipulation': 'error',
+    'jwt/require-max-age': 'error',
+    'jwt/no-sensitive-payload': 'error',
+};
+/**
+ * Legacy configuration - migration mode
+ * Only critical rules enabled
+ */
+const legacyRules = {
+    // Only most critical rules
+    'jwt/no-algorithm-none': 'error',
+    'jwt/no-algorithm-confusion': 'error',
+    'jwt/no-hardcoded-secret': 'warn',
+};
+/**
+ * Configuration presets for flat config
+ */
+exports.configs = {
+    /**
+     * Flagship preset — the rule from this plugin in the ecosystem-wide
+     * flagship list (`.agent/flagship-rules.md`). Use this when you want
+     * the highest-signal JWT subset shippable in CI gates.
+     */
+    flagship: {
+        plugins: {
+            jwt: exports.plugin,
+        },
+        rules: {
+            'jwt/no-algorithm-none': 'error',
+        },
+    },
+    /**
+     * Recommended preset - balanced security
+     */
+    recommended: {
+        plugins: {
+            jwt: exports.plugin,
+        },
+        rules: recommendedRules,
+    },
+    /**
+     * Strict preset - maximum security (includes 2025 research)
+     */
+    strict: {
+        plugins: {
+            jwt: exports.plugin,
+        },
+        rules: strictRules,
+    },
+    /**
+     * Legacy preset - migration mode
+     */
+    legacy: {
+        plugins: {
+            jwt: exports.plugin,
+        },
+        rules: legacyRules,
+    },
+    /**
+     * All rules preset
+     */
+    all: {
+        plugins: {
+            jwt: exports.plugin,
+        },
+        rules: strictRules,
+    },
+};
+// Default export for flat config usage
+exports.default = exports.plugin;

package/dist/src/oxlint.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * oxlint sub-export.
+ *
+ * Consumers wire oxlint to this entry via:
+ *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
+ *
+ * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
+ * `.rules` off the result. The compiled output of `export = plugin` is
+ * `module.exports = plugin`, which gives oxlint the plugin object directly
+ * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
+ *
+ * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
+ */
+import { plugin } from './index';
+export = plugin;

package/dist/src/oxlint.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * oxlint sub-export.
+ *
+ * Consumers wire oxlint to this entry via:
+ *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
+ *
+ * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
+ * `.rules` off the result. The compiled output of `export = plugin` is
+ * `module.exports = plugin`, which gives oxlint the plugin object directly
+ * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
+ *
+ * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
+ */
+const index_1 = require("./index");
+module.exports = index_1.plugin;

package/dist/src/rules/no-algorithm-confusion/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-algorithm-confusion
+ *
+ * Detects algorithm confusion attacks where symmetric algorithms (HS256/384/512)
+ * are used with asymmetric keys (public keys). This allows attackers to sign
+ * tokens using the public key as an HMAC secret.
+ *
+ * CWE-347: Improper Verification of Cryptographic Signature
+ *
+ * @see https://portswigger.net/web-security/jwt/algorithm-confusion
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+import type { NoAlgorithmConfusionOptions } from '../../types';
+type MessageIds = 'algorithmConfusion' | 'symmetricWithPublicKey' | 'useAsymmetricAlgorithm';
+type RuleOptions = [NoAlgorithmConfusionOptions?];
+export declare const noAlgorithmConfusion: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export default noAlgorithmConfusion;

package/dist/src/rules/no-algorithm-confusion/index.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noAlgorithmConfusion = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const utils_1 = require("../../utils");
+// Patterns that indicate a public key
+const PUBLIC_KEY_PATTERNS = [
+    /public/i,
+    /\.pub$/,
+    /\.pem$/,
+    /-----BEGIN PUBLIC KEY-----/,
+    /-----BEGIN RSA PUBLIC KEY-----/,
+    /-----BEGIN EC PUBLIC KEY-----/,
+    /getPublicKey/i,
+    /publicKey/i,
+    /jwks/i,
+];
+exports.noAlgorithmConfusion = (0, eslint_devkit_1.createRule)({
+    name: 'no-algorithm-confusion',
+    meta: {
+        type: 'problem',
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-confusion.md',
+            description: 'Prevent algorithm confusion attacks using symmetric algorithms with asymmetric keys',
+            cwe: 'CWE-347',
+            cvss: 9.5,
+        },
+        fixable: undefined,
+        hasSuggestions: false,
+        messages: {
+            algorithmConfusion: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'JWT Algorithm Confusion Attack',
+                cwe: 'CWE-347',
+                description: 'Symmetric algorithm (HS*) used with public key allows token forgery',
+                severity: 'CRITICAL',
+                fix: 'Use asymmetric algorithms (RS256, ES256) with public keys',
+                documentationLink: 'https://portswigger.net/web-security/jwt/algorithm-confusion',
+            }),
+            symmetricWithPublicKey: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Symmetric Algorithm with Public Key',
+                cwe: 'CWE-347',
+                description: 'HS256/384/512 should only be used with shared secrets, not public keys',
+                severity: 'CRITICAL',
+                fix: 'Switch to RS256 or ES256 for asymmetric key verification',
+                documentationLink: 'https://portswigger.net/web-security/jwt/algorithm-confusion',
+            }),
+            useAsymmetricAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Asymmetric Algorithm',
+                description: 'Replace HS* with RS* or ES* algorithm',
+                severity: 'LOW',
+                fix: 'Use RS256 or ES256 with public key verification',
+                documentationLink: 'https://tools.ietf.org/html/rfc8725',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    symmetricAlgorithms: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['HS256', 'HS384', 'HS512'],
+                        description: 'Algorithms to flag when used with public keys',
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            symmetricAlgorithms: ['HS256', 'HS384', 'HS512'],
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] ?? {};
+        const symmetricAlgSet = new Set(options.symmetricAlgorithms ?? ['HS256', 'HS384', 'HS512']);
+        const sourceCode = context.sourceCode;
+        /**
+         * Check if a node looks like a public key reference
+         */
+        const looksLikePublicKey = (node) => {
+            const text = sourceCode.getText(node);
+            return PUBLIC_KEY_PATTERNS.some((pattern) => pattern.test(text));
+        };
+        /**
+         * Check if algorithms include symmetric algorithms
+         */
+        const hasSymmetricAlgorithm = (algorithms) => {
+            for (const alg of algorithms) {
+                if (symmetricAlgSet.has(alg)) {
+                    return alg;
+                }
+            }
+            return null;
+        };
+        return {
+            CallExpression(node) {
+                // Only check verify operations
+                if (!(0, utils_1.isVerifyOperation)(node)) {
+                    return;
+                }
+                // Need at least 2 arguments: token, key
+                if (node.arguments.length < 2) {
+                    return;
+                }
+                const keyArg = node.arguments[1];
+                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
+                // Check if key looks like a public key
+                if (!looksLikePublicKey(keyArg)) {
+                    return;
+                }
+                // If there are options, check the algorithms
+                if (optionsArg) {
+                    const algorithms = (0, utils_1.extractAlgorithms)(optionsArg);
+                    const symmetricAlg = hasSymmetricAlgorithm(algorithms);
+                    if (symmetricAlg) {
+                        // Find the algorithm node for precise error location
+                        for (const prop of optionsArg.properties) {
+                            if (prop.type === 'Property' &&
+                                prop.key.type === 'Identifier' &&
+                                ['algorithms', 'algorithm', 'alg'].includes(prop.key.name)) {
+                                context.report({
+                                    node: prop.value,
+                                    messageId: 'algorithmConfusion',
+                                    data: { algorithm: symmetricAlg },
+                                });
+                                return;
+                            }
+                        }
+                    }
+                }
+                // If no options specified but key looks like public key,
+                // and we're in verify, flag as potential issue
+                // (verification without explicit algorithm with public key is risky)
+            },
+        };
+    },
+});
+exports.default = exports.noAlgorithmConfusion;

package/dist/src/rules/no-algorithm-none/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-algorithm-none
+ *
+ * Detects attempts to use the 'none' algorithm which bypasses JWT signature verification.
+ * This is a critical vulnerability (CVE-2022-23540) that allows attackers to forge JWT tokens.
+ *
+ * CWE-347: Improper Verification of Cryptographic Signature
+ *
+ * @see https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+ * @see https://tools.ietf.org/html/rfc8725
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+import type { NoAlgorithmNoneOptions } from '../../types';
+type MessageIds = 'algorithmNone' | 'algorithmNoneInArray' | 'emptyAlgorithms' | 'useSecureAlgorithm' | 'decodeWithoutVerify';
+type RuleOptions = [NoAlgorithmNoneOptions?];
+export declare const noAlgorithmNone: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export default noAlgorithmNone;

package/dist/src/rules/no-algorithm-none/index.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noAlgorithmNone = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const utils_1 = require("../../utils");
+exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
+    name: 'no-algorithm-none',
+    meta: {
+        type: 'problem',
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/no-algorithm-none.md',
+            description: 'Disallow JWT "none" algorithm which bypasses signature verification (CVE-2022-23540)',
+            cwe: 'CWE-347',
+            cvss: 9.5,
+            confidence: 'high',
+        },
+        fixable: undefined,
+        hasSuggestions: false,
+        messages: {
+            algorithmNone: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'JWT Algorithm None Attack',
+                cwe: 'CWE-347',
+                description: 'Using alg:"none" bypasses signature verification, allowing token forgery',
+                severity: 'CRITICAL',
+                fix: 'Remove "none" and use RS256, ES256, or other secure algorithms',
+                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
+            }),
+            algorithmNoneInArray: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'JWT Algorithm None in Whitelist',
+                cwe: 'CWE-347',
+                description: 'Including "none" in algorithms array allows unsigned tokens',
+                severity: 'CRITICAL',
+                fix: 'Remove "none" from the algorithms array',
+                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23540',
+            }),
+            emptyAlgorithms: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Empty Algorithms Array',
+                cwe: 'CWE-347',
+                description: 'Empty algorithms array may default to accepting any algorithm including none',
+                severity: 'HIGH',
+                fix: 'Specify explicit algorithms: ["RS256"] or ["ES256"]',
+                documentationLink: 'https://tools.ietf.org/html/rfc8725',
+            }),
+            useSecureAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Secure Algorithm',
+                description: 'Replace with a secure algorithm',
+                severity: 'LOW',
+                fix: 'Use algorithms: ["RS256"] or algorithms: ["ES256"]',
+                documentationLink: 'https://tools.ietf.org/html/rfc8725',
+            }),
+            decodeWithoutVerify: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'JWT Decode Without Verify',
+                cwe: 'CWE-347',
+                description: 'jwt.decode() does NOT verify the signature — using its result as if it were authenticated is functionally equivalent to algorithm:"none". Any token, including forged ones, will decode.',
+                severity: 'CRITICAL',
+                fix: 'Use jwt.verify(token, secret, { algorithms: ["RS256"] }) instead. Reserve jwt.decode() for non-security inspection only (e.g. logging the issuer).',
+                documentationLink: 'https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow "none" algorithm in test files',
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] ?? {};
+        const { allowInTests = false } = options;
+        const filename = context.filename;
+        // Skip test files if configured
+        if (allowInTests && (0, utils_1.isTestFile)(filename)) {
+            return {};
+        }
+        /**
+         * Check if an algorithm value is 'none' (case insensitive)
+         */
+        // oxlint-disable-next-line consistent-function-scoping
+        const isNoneAlgorithm = (value) => {
+            return value.toLowerCase() === 'none';
+        };
+        /**
+         * Check options object for 'none' algorithm
+         */
+        const checkOptionsForNone = (optionsNode) => {
+            for (const prop of optionsNode.properties) {
+                if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
+                    continue;
+                }
+                const keyName = prop.key.name;
+                if (keyName !== 'algorithms' &&
+                    keyName !== 'algorithm' &&
+                    keyName !== 'alg') {
+                    continue;
+                }
+                // Single algorithm: { algorithm: 'none' }
+                if (prop.value.type === 'Literal' &&
+                    typeof prop.value.value === 'string') {
+                    if (isNoneAlgorithm(prop.value.value)) {
+                        context.report({
+                            node: prop.value,
+                            messageId: 'algorithmNone',
+                        });
+                    }
+                }
+                // Array of algorithms: { algorithms: ['none'] } or { algorithms: [] }
+                if (prop.value.type === 'ArrayExpression') {
+                    // Check for empty array
+                    if (prop.value.elements.length === 0) {
+                        context.report({
+                            node: prop.value,
+                            messageId: 'emptyAlgorithms',
+                        });
+                        continue;
+                    }
+                    // Check each element for 'none'
+                    for (const elem of prop.value.elements) {
+                        if (elem &&
+                            elem.type === 'Literal' &&
+                            typeof elem.value === 'string' &&
+                            isNoneAlgorithm(elem.value)) {
+                            context.report({
+                                node: elem,
+                                messageId: 'algorithmNoneInArray',
+                            });
+                        }
+                    }
+                }
+            }
+        };
+        /**
+         * Detect `jwt.decode()` calls — closes the audit FN where
+         * `jwt.decode(token)` followed by trusting the decoded payload was
+         * silent, despite being functionally equivalent to algorithm:"none".
+         * See benchmarks/AUDIT_PATTERNS.md §3.8 ("verify-then-trust mismatch").
+         *
+         * The check is conservative: we flag every `jwt.decode()` call. In
+         * the rare case where `decode` is used legitimately (e.g. logging
+         * the issuer of an inbound token without authentication semantics),
+         * the user can disable the rule on that line. The default-on
+         * behaviour is correct — most production uses of `jwt.decode` are
+         * authentication mistakes.
+         */
+        // oxlint-disable-next-line consistent-function-scoping
+        function isDecodeCall(node) {
+            const callee = node.callee;
+            if (callee.type !== 'MemberExpression')
+                return false;
+            if (callee.property.type !== 'Identifier')
+                return false;
+            if (callee.property.name !== 'decode')
+                return false;
+            // Object should be `jwt` (or imported as such). Check both
+            // `jwt.decode` and `JWT.decode` patterns.
+            if (callee.object.type === 'Identifier') {
+                const name = callee.object.name.toLowerCase();
+                return name === 'jwt' || name === 'jsonwebtoken';
+            }
+            return false;
+        }
+        return {
+            CallExpression(node) {
+                // Detect `jwt.decode(...)` — equivalent to algorithm:"none" if
+                // its result is trusted. We always flag (with critical severity)
+                // because the FN risk far outweighs the FP risk on real code.
+                if (isDecodeCall(node)) {
+                    context.report({ node, messageId: 'decodeWithoutVerify' });
+                    return;
+                }
+                // Check both verify and sign operations
+                if (!(0, utils_1.isVerifyOperation)(node) && !(0, utils_1.isSignOperation)(node)) {
+                    return;
+                }
+                // Get options argument (usually 3rd argument)
+                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
+                if (optionsArg) {
+                    checkOptionsForNone(optionsArg);
+                }
+            },
+        };
+    },
+});
+exports.default = exports.noAlgorithmNone;

package/dist/src/rules/no-decode-without-verify/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-decode-without-verify
+ *
+ * Detects usage of jwt.decode() or jwt-decode library without corresponding
+ * verification. Decoded JWTs can be tampered with by attackers.
+ *
+ * CWE-345: Insufficient Verification of Data Authenticity
+ *
+ * @see https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+import type { NoDecodeWithoutVerifyOptions } from '../../types';
+type MessageIds = 'decodeWithoutVerify' | 'jwtDecodeLibrary' | 'useVerifyInstead';
+type RuleOptions = [NoDecodeWithoutVerifyOptions?];
+export declare const noDecodeWithoutVerify: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export default noDecodeWithoutVerify;