Critical Vulnerabilities in JSON Web Token Libraries

Re:Critical Vulnerabilities in JSON Web Token Libraries by omgitstom on Wednesday April 01, 2015 @10:42AM (#9303955)

I've actually seen this same issue in JWT libs before (August 2014) as well. I think one of the main issue is JWT is simple to implement, the specification seems to be unclear about how to treat unsecure JWTs (with the `none` alg).

From the specificaiton: Even if a JWT can be successfully validated, unless the algorithm(s) used in the JWT are acceptable to the application, it SHOULD reject the JWT.

So what it is saying is that you should have code in your application to make sure to only trust algorithms that you like.

The other issue is that following the specifications rules for validation get you in a hairy spot where this vulnerability exist:

https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-...

[ Parent | on HN ]

Re:Critical Vulnerabilities in JSON Web Token Libraries by btilly on Wednesday April 01, 2015 @02:05PM (#9305557)

You didn't read carefully enough.

Your site may well find both HMAC and RSA to be acceptable algorithms. However if you can be tricked into using HMAC to verify something actually signed with RSA, then anyone can forge content you accept as valid.

What is important is not that the algorithm is acceptable. It is that the algorithm you use for verification is the algorithm that actually should be used.

[ Parent | on HN ]