diff --git a/lib/insecurity.ts b/lib/insecurity.ts
index b1b7f82c720..3118baab5e4 100644
--- a/lib/insecurity.ts
+++ b/lib/insecurity.ts
@@ -51,7 +51,19 @@ export const cutOffPoisonNullByte = (str: string) => {
   return str
 }
 
-export const isAuthorized = () => expressJwt(({ secret: publicKey }) as any)
+export const isAuthorized = () => {
+  const jwtMiddleware = expressJwt(({ secret: publicKey }) as any)
+  return (req: Request, res: Response, next: NextFunction) => {
+    const token = utils.jwtFrom(req)
+    if (token) {
+      const tokenHeader = jws.decode(token)
+      if (!tokenHeader?.header?.alg || (tokenHeader.header.alg as string).toLowerCase() === 'none') {
+        return res.status(401).json({ status: 'error', message: 'Unauthorized' })
+      }
+    }
+    jwtMiddleware(req, res, next)
+  }
+}
 export const denyAll = () => expressJwt({ secret: '' + Math.random() } as any)
 export const authorize = (user = {}) => jwt.sign(user, privateKey, { expiresIn: '6h', algorithm: 'RS256' })
 export const verify = (token: string) => token ? (jws.verify as ((token: string, secret: string) => boolean))(token, publicKey) : false
@@ -188,14 +200,17 @@ export const appendUserId = () => {
 export const updateAuthenticatedUsers = () => (req: Request, res: Response, next: NextFunction) => {
   const token = req.cookies.token || utils.jwtFrom(req)
   if (token) {
-    jwt.verify(token, publicKey, (err: Error | null, decoded: any) => {
-      if (err === null) {
-        if (authenticatedUsers.get(token) === undefined) {
-          authenticatedUsers.put(token, decoded)
-          res.cookie('token', token)
+    const tokenHeader = jws.decode(token)
+    if (tokenHeader?.header?.alg && (tokenHeader.header.alg as string).toLowerCase() !== 'none') {
+      jwt.verify(token, publicKey, (err: Error | null, decoded: any) => {
+        if (err === null) {
+          if (authenticatedUsers.get(token) === undefined) {
+            authenticatedUsers.put(token, decoded)
+            res.cookie('token', token)
+          }
         }
-      }
-    })
+      })
+    }
   }
   next()
 }