Re:Critical Vulnerabilities in JSON Web Token Libraries
by jfroma on Wednesday April 01, 2015 @07:17AM
(#9302818)
I think the main concept you are missing is called HMAC, which is a cryptography thing. If you don't know this, I will recommend this explanation [1].
The client can send something wrong? Yes, as long as the client can digital sign what is sending with the secret you expect.
JWTs can be signed with a symmetric key or an asymmetric key, the vulnerability mentioned in this post is when the server-side expect a token digitally signed with an asymmetric key but an unauthorized client uses the public key to create a signature as if the key where symmetric. The issue in this case is when the server is blindly accepting any algorithm.
The client can send something wrong? Yes, as long as the client can digital sign what is sending with the secret you expect.
JWTs can be signed with a symmetric key or an asymmetric key, the vulnerability mentioned in this post is when the server-side expect a token digitally signed with an asymmetric key but an unauthorized client uses the public key to create a signature as if the key where symmetric. The issue in this case is when the server is blindly accepting any algorithm.
[1]: http://security.stackexchange.com/a/20301/9332