Jailkey

Cracking the JWT token secret isn't always possible (which is the case when developers have at least some awareness of the dangers of weak or hardcoded credentials). However, failing to read the RFC for a complex technology can land you in serious trouble. If an attacker is given the chance to choose the cryptographic algorithm used to verify the payload's integrity, they would likely choose the "none" option.