Vulnerability / Unexpected Token Verification Behavior with Private Key
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- authentication, security
Research direction
Start by reproducing the reported behavior with Node.js's crypto module and the JWT sign and verify entry points, using the RS256 steps described in the issue. Check the documented key-handling expectations for versions 8.5.1 and 9.0.1; done means the behavior is explained and the expected outcome or required change is clearly established.
Written by the indexing model from the issue text.
Description
Issue Title: Unexpected Token Verification Behavior with Private Key
Description:
I've encountered unexpected behavior while using the jsonwebtoken library for token verification. As per best practices, I'm aware that token verification should use the public key, but I noticed that token verification is succeeding even when using the private key.
Steps to Reproduce:
Generate an RSA key pair using the crypto module.
Sign a JWT using the private key with the RS256 algorithm.
Attempt to verify the JWT using the private key instead of the public key.
Expected Behavior:
Token verification using the private key should fail, as the private key is meant for signing, not verification.
Actual Behavior:
Token verification using the private key surprisingly succeeds, which contradicts the expected behavior.
Environment:
Node.js version: v16.19.0
jsonwebtoken library version: 9.0.1/8.5.1 -> In these versions I have checked.
Operating System: Windows 10
Additional Information:
I've verified this behavior in multiple environments to ensure accuracy. It's important to clarify that this behavior goes against established best practices for token verification. I would appreciate assistance in understanding if this is an issue or if there's a valid explanation for this behavior.
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
mksglu/context-mode#1200 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
neondatabase/website#5944 ·
-
module: core
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
bigbluebutton/bigbluebutton#25849 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
jaegertracing/jaeger-ui#4506 ·