-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Deprecate/remove the parse() method #212
Comments
Yeah, we decided a while ago to remove this before 1.0 final (it was useful for some testing and 'power' scenarios). I'll leave this open to track that modification. Thanks! |
fyi, today this issue was used in a security competition to perform an Elevation of Privilege attack: |
@stefan2904 yep, this is expected. Our documentation says don't use |
Given that the final RFC specification requires the See https://tools.ietf.org/html/rfc7515#section-4.1.1 - first paragraph, last sentence - |
Per discussion here, this has been addressed in the |
|
Following the email thread “jjwt signature validation bypass” and a couple of issues here (#193, #90, plus several others related to the post in Auth0's blog):
At least some portion of JJWT users confuse the
JwtParser#parse()
to be the main method for parsing signed JWT-s, while in fact it will also happily parse unsigned JWT-s (even ifalg
header is set to something other thannone
.)As a side note: I thought about proposing as a partial fix to make
parse()
throw ifalg
is notnone
and signature part is missing, but then decided against that, because it potentially could create an illusion of safety (“no signature → failure, I tested!”), while for the real attacker it's only one additional step to updatealg
header after stripping the signature.The text was updated successfully, but these errors were encountered: