4 ms·
Use the flaws to exploit an AWS, Azure or Google product? And if you can't, are they really flaws? Or is this just an issue of some people implementing the sta
by SamBam 5y ago
Use the flaws to exploit an AWS, Azure or Google product?
And if you can't, are they really flaws? Or is this just an issue of some people implementing the standard badly, and they need to be taught to use better libraries?
- Godel_unicode 5y agoI might slightly amend that to the less illegal "use the flaws to submit bugs to their bounty programs and get paid for your time".
- ori_b 5y agoYou mean, like this? https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... It's certainly possible to use JWT correctly, and with sufficient resources put towards auditing, most flaws will be caught. This doesn't make it a good design.
- GoblinSlayer 5y agoIt's linked in the article: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ https://auth0.com/blog/critical-vulnerabilities-in-json-web-...