3 ms·
And how, precisely, do you propose doing this convincing without popularizing the idea that it's a bad API?
by ori_b 5y ago
And how, precisely, do you propose doing this convincing without popularizing the idea that it's a bad API?
- SamBam 5y agoUse the flaws to exploit an AWS, Azure or Google product? And if you can't, are they really flaws? Or is this just an issue of some people implementing the standard badly, and they need to be taught to use better libraries?
- Godel_unicode 5y agoI might slightly amend that to the less illegal "use the flaws to submit bugs to their bounty programs and get paid for your time".
- ori_b 5y agoYou mean, like this? https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... It's certainly possible to use JWT correctly, and with sufficient resources put towards auditing, most flaws will be caught. This doesn't make it a good design.
- GoblinSlayer 5y agoIt's linked in the article: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ https://auth0.com/blog/critical-vulnerabilities-in-json-web-...