---
title: Verify JWT signatures properly
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Verify JWT signatures properly
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Verify JWT signatures properly

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/insecure-jwt`

**Language:** Dart

**Severity:** Error

**Category:** Security

**CWE**: [347](https://cwe.mitre.org/data/definitions/347.html)

## Description{% #description %}

Calling `JWT.decode()` skips signature verification entirely, allowing any token to be accepted without checking its authenticity. Similarly, including `JWTAlgorithm.none` in allowed algorithms disables signature verification, enabling an attacker to forge arbitrary claims including user identity and roles.

Always use `JWT.verify()` with a strong signing key and never include `JWTAlgorithm.none` in the allowed algorithms.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT trustToken(String token) {
  // Skips signature verification entirely
  return JWT.decode(token);
}
```

```dart
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT acceptNone(String token) {
  return JWT.verify(
    token,
    SecretKey('secret'),
    allowedAlgorithms: [JWTAlgorithm.none],
  );
}
```

```dart
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

void process(String token) {
  final decoded = JWT.decode(token);
  final risky = JWT.verify(token, SecretKey('s'), allowedAlgorithms: [JWTAlgorithm.none]);
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT validateToken(String token) {
  return JWT.verify(token, SecretKey('strongSecretKey'));
}
```

```dart
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT validateToken(String token, RSAPublicKey publicKey) {
  return JWT.verify(token, RSAPublicKey(publicKey));
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}