Re:# of days since the last alg=none JWT vulnerability
by jimktrains2 on Tuesday September 01, 2020 @07:23PM
(#24348276)
Yes, some libraries provide a key callback function where the unauthenticated token is provided for this type of thing, but the result of the function is supposed to be the key used to verify the token and nothing else is supposed to happen as a side effect.
[ Parent
| on HN ]
Re:# of days since the last alg=none JWT vulnerability
by hinkley on Tuesday September 01, 2020 @07:41PM
(#24348411)
Oh good, that's what I hoped.
Yes, you could have side effects, but it's pretty damned obvious you're being naughty. That's mostly what I want. The obviousness of the cheating makes people think twice, ask questions. Slow down.