Breaking JSON Web Tokens: My Hunt for the “alg:none” Vulnerability in crAPI

Part 1 of a 2-part series on JWT attacks against crAPI [Read part 2 here]