5 ms·
> Also, WTF is wrong with people who accepted algorithm "none." They dared to use the default validation function of their JWT library. They did not choose to
by RagingCactus 4mo ago
> Also, WTF is wrong with people who accepted algorithm "none."
They dared to use the default validation function of their JWT library. They did not choose to accept "none".
And the library authors implemented it because it's in the spec. It doesn't excuse that the default was to accept "none", but it is an explanation and in my opinion a valid critique of the standard.
- jongjong 4mo agoYeah well it's definitely a footgun built into the spec but ultimately an library implementation mistake.
- robertlagrant 4mo agoYou could have a SQL library that defaults to inserting "OR 1=1" to every update query, which the SQL standard allows. I would blame the library.
- inigyou 4mo agoThe SQL library is meant to run the query you give it.
- robertlagrant 3mo agoBut then "meant to" is doing the heavy lifting here. You could (and should) say that a JWT library is meant to default to secure.