New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JWT Concerns #79

Closed

kousu opened this issue Mar 15, 2017 · 1 comment

kousu commented Mar 15, 2017

This security firm thinks that JWT and friends are. I wonder if you are aware of the issues they raise, and how you mitigate them in itsdangerous?

https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid

Contributor

untitaker commented Mar 15, 2017

This library uses JWS, with HMAC-SHA1 as fixed signing algorithm. It uses a very specific subset of the standard, so most of the post doesn't apply.

untitaker closed this as completed

github-actions bot locked as resolved and limited conversation to collaborators

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.