Re:# of days since the last alg=none JWT vulnerability
by judge2020 on Tuesday September 01, 2020 @07:08PM
(#24348172)
Python's approach seems reasonable, where you have to go out of your way to learn about and perform this workaround:
https://stackoverflow.com/a/9145524/3878893
[ Parent
| on HN ]
Re:# of days since the last alg=none JWT vulnerability
by hinkley on Tuesday September 01, 2020 @07:22PM
(#24348266)
ES6 has a way to name functions with Symbols, and Symbols with the same name are not equal. It's not used often but I've seen it used to give a secret back entrance to an object. Like a very limited version of friend functions/classes.
If the symbol is not exposed, then you can't get anywhere in the neighborhood of calling it accidentally. I think if you do enough object introspection you can still get the function handle, but you could never mistake the resulting code for being anything other than farm fresh, Grade-A Cheese.