4 ms·
A subset of JWTs sounds great given the previous security vulnerabilities found in JWTs and the huge surface area they give you: https://www.akto.io/blog/jwt-n
by grey-area 3y ago
A subset of JWTs sounds great given the previous security vulnerabilities found in JWTs and the huge surface area they give you:
https://www.akto.io/blog/jwt-none-algorithm-test https://www.akto.io/blog/jwt-none-algorithm-test
- robertlagrant 3y agoThis is not a huge surface area. I don't know why this keeps coming up, but, while a silly default, is incredibly straightforward to not configure / remove / test for.
- grey-area 3y agoJWTs are definitely a much larger surface area than simpler encrypted sessions storage and most people don’t need that. I cited this as one example of that surface area that led to serious vulnerabilities. Most people don’t need multiple ways to encrypt their data, and certainly not a ‘no encryption’ option. Each added option adds more ways to mess things up.