Fix JWT alg:none bypass on the refresh-token lesson (Challenge-56) - #491

Closed

beanbeah wants to merge 3 commits into

OWASP-CTF:dc34-ctffrom

beanbeah:ctf/r2-challenge-challenge-56-jwt-refresh-token

Commits on Aug 9, 2026

fix(build): bump lombok to 1.18.46 for JDK 25 CI compatibility

beanbeah
and
claude
committed
a30f123
fix(jwt): reject alg:none tokens on the refresh-token checkout/newToken endpoints

beanbeah
and
claude
committed
cd40ab3
fix(jwt): correct parseClaimsJws() return type (Jws<Claims>, not Jwt<Header,Claims>)

beanbeah
and
claude
committed
7116686