# of days since the last alg=none JWT vulnerability

Re:# of days since the last alg=none JWT vulnerability by will4274 on Wednesday September 02, 2020 @12:36PM (#24354938)

Literally incorrect. You can't verify the jwt prior to reading the header, because you don't know which of the advertised keys was used to sign the jwt.

Check out e.g. auth0's doc. https://auth0.com/docs/tokens/json-web-tokens/validate-json-...

[ Parent | on HN ]

Re:# of days since the last alg=none JWT vulnerability by shakna on Wednesday September 02, 2020 @06:51PM (#24359126)

I assume you're refering to this part of the spec:

> If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations. In this case, return to Step 1, using the Message as the JWT. [0]

This is also step 8 of validating a JWT. There is a number of validation steps you need to take before you can decide how to process the payload.

You'll also note that none of the previous 7 steps actually decode the payload ("the Message") - they only find it. And 4 of those steps are about verifying that the header isn't dangerous.

[0] https://tools.ietf.org/html/rfc7519#section-7.2

[ Parent | on HN ]