News for hackers. Stuff that matters.

A comment on Critical Vulnerabilities in JSON Web Token Libraries. Parent comment

Re:Critical Vulnerabilities in JSON Web Token Libraries by ploxiln on Wednesday April 01, 2015 @02:15AM (#9301904)
That's a great link (which I've seen before) and I upvoted it.

But these "typical JWT lib api vulns" are WAY SIMPLER than Vaudenay etc. Any programmer could do this in minutes or less. WOW. It's so obvious and straightforward (in hindsight I suppose). My mouth is still hanging open.

[ Parent | on HN ]
Re:Critical Vulnerabilities in JSON Web Token Libraries by bbrazil on Wednesday April 01, 2015 @03:53AM (#9302224)
We've recently been looking at adding JWT, and one of the things I looked out for was that we were protected against downgrade attacks. This was done both as a check of the current library code, and an explicit check on our side that the alg is what we expect to protect against future library changes.
[ Parent | on HN ]