Injection: JWT Signature check¶

Identifier: jwt_sign_check

Scanner(s) Support¶

Description¶

JWTs rely on a secret signature to ensure that the token hasn't been tampered with. When a server accepts a token with an incorrect signature, it means there's a flaw in the verification process, letting attackers change key information in the token. The danger here is that attackers could impersonate users, escalate privileges, or access resources they shouldn't by exploiting that weak signature check. Common mistakes include using lax algorithms, not enforcing strict signature verification, or improper handling of token libraries. This vulnerability can essentially let unauthorized parties bypass security controls if left unaddressed.

References:

• https://www.freecodecamp.org/news/how-to-sign-and-validate-json-web-tokens/

Configuration¶

Example¶

Example configuration:

---
security_tests:
  jwt_sign_check:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.