JWT Key ID Injector - Simple Python Script To Check Against Hypothetical JWT Vulnerability

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.zbgd5BNF1cqQ_prCEqIvBTjSxMS8bDLnJAE_wE-0Cxg

Above token can be decoded to the following data:

{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

To calculate signature the following secret is used:

supersecret

The following pseudo code is used to calculate signature:

$alg = "sha256";
$data = "...";
$key = "supersecret";

hmac($alg, $data, $key);

But what if unexpected "kid":0 field will be injected into the header?

{
  "alg": "HS256",
  "typ": "JWT",
  "kid": 0
}
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

kid field is a standard way to choose a key. My assumption is that, if kid field is not expected, there may be Intruder. If any token is valid (what means that application is vulnerable), tokens_meta.txt file can be used to check what algorithm and secret were used to generate the given token. tokens_meta.txt file contains the following data:

token1:algorithm:secret
...
token{n}:algorithm:secret

Please see the