Re:# of days since the last alg=none JWT vulnerability
by azinman2 on Tuesday September 01, 2020 @06:10PM
(#24347731)
I saw a set of junior devs implementing this thinking it was encryption, and not understanding the difference. I feel like the main JWT page needs a big warning that says “this is not encryption, but a way to verify the contents have not been modified by anyone but you”
[ Parent
| on HN ]
Re:# of days since the last alg=none JWT vulnerability
by gavinray on Tuesday September 01, 2020 @06:20PM
(#24347802)
Hey, I can't deny that was me 5 years ago. I was totally putting emails and other personal info into JWT's because "Hey, it's encrypted".
Live and learn haha
But yeah, definitely some lack of awareness around how JWT's work + best practices.
I think that Auth-as-a-Service platforms and the "npm install" culture aren't helping this at all.
In recent years from conversations with other devs, it seems like many of them have never written an auth system themselves + couldn't do it if you asked. Coming from an era where rolling your own token-auth setup, or on larger projects even custom OAuth providers, this is both a bit mindblowing and kind of scary.