Pin algorithms to defeat algorithm confusion

Signed JWTs carry the signing algorithm in the "alg" Header Parameter to enable cryptographic agility, but flaws in some libraries turned this into attacks: an attacker can change the algorithm to "none" and some libraries would "validate" the JWT without checking any signature, or change "RS256" (RSA, 2048 bit) into "HS256" (HMAC, SHA-256) so the library verifies an HMAC using the RSA public key as the shared secret (CVE-2015-9235). RFC 8725 mitigations: libraries MUST let the caller specify a supported set of algorithms and MUST NOT use any others; the "alg" or "enc" header MUST specify the same algorithm used for the cryptographic operation; and each key MUST be used with exactly one algorithm, checked when the operation is performed. The "none" algorithm should only be used when the JWT is cryptographically protected by other means, such as TLS, and libraries SHOULD NOT generate or consume "none" JWTs unless the caller explicitly requests it. Scope: JWT security. Reviewed October 4, 2026.