News for hackers. Stuff that matters.

A comment on Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful. Parent comment

Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by applecrazy on Thursday April 16, 2020 @12:27PM (#22891003)
Just wanted to point out the supreme irony: Auth0 wrote that library.
[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by Arnout on Thursday April 16, 2020 @12:53PM (#22891274)
Hah. They could still improve it by only accepting a single algorithm, rather than a list.

edit: though there could be some internal use cases where you want a list, but it's a tradeoff between flexibility and making it easy for people to shoot themselves in the foot.

[ Parent | on HN ]
Re:Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Har... by wongarsu on Thursday April 16, 2020 @03:54PM (#22892841)
If you don't set it it's set to a reasonable list of algorithms [0], which doesn't include "none"

https://github.com/auth0/node-jsonwebtoken/blob/master/verif...

[ Parent | on HN ]