News for hackers. Stuff that matters.

A comment on Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful. Parent comment

Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by Arnout on Thursday April 16, 2020 @12:16PM (#22890873)
Various, been a while since I wrote code using them myself.

Often JWT tokens come from sources other than our own and they will have passed through user agent or client land. Don't trust anything in them unless you verified them.

edit: good on that library! That's what it should do. Clearly auth0's code did not do that though, it should never have accepted any variant of 'none' in the first place.

[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by applecrazy on Thursday April 16, 2020 @12:27PM (#22891003)
Just wanted to point out the supreme irony: Auth0 wrote that library.
[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by Arnout on Thursday April 16, 2020 @12:53PM (#22891274)
Hah. They could still improve it by only accepting a single algorithm, rather than a list.

edit: though there could be some internal use cases where you want a list, but it's a tradeoff between flexibility and making it easy for people to shoot themselves in the foot.

[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by wongarsu on Thursday April 16, 2020 @03:54PM (#22892841)
If you don't set it it's set to a reasonable list of algorithms [0], which doesn't include "none"

https://github.com/auth0/node-jsonwebtoken/blob/master/verif...

[ Parent | on HN ]