gchq/CyberChef

Bug report: JWT Verify doesn't require an algorithm

Open

#624 opened on Aug 27, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)JavaScript (3,944 forks)batch import
featurehelp wanted

Repository metrics

Stars
 (34,843 stars)
PR merge metrics
 (Avg merge 57d 13h) (62 merged PRs in 30d)

Description

As detailed here, JWT verification functions should require specifying the algorithm that should have been used, in order to prevent an attacker from changing the algorithm to a symmetric algorithm from an asymmetric one and using the public key to sign the token. Probably low priority for this particular app, but it would be good to at least have the option.

Contributor guide

Research direction
Add an algorithm parameter to the JWT Verify function to prevent algorithm confusion attacks. Refer to the security advisory linked in the issue.
Tech stack
javascript
Domain
frontend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaScript
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70