Sensitive Data: JWT Token Leak in JavaScript Bundle¶

Identifier: js_data_leak_jwt_token

Scanner(s) Support¶

Description¶

JSON Web Tokens hardcoded in JavaScript bundles expose bearer credentials that attackers can replay to access protected resources. JWTs are only base64-encoded, not encrypted, and should not be embedded in client-side code where they can be copied from the bundle.

How we test: We statically analyze first-party JavaScript bundles for patterns matching JWT structures (three base64url-encoded segments separated by dots).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• OWASP Top 10 2021: A01 Broken Access Control
• RFC 7519: JSON Web Token (JWT)

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_jwt_token:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.