3 ms·
That's a great link (which I've seen before) and I upvoted it. But these "typical JWT lib api vulns" are WAY SIMPLER than Vaudenay etc. Any programmer could do
by ploxiln 12y ago
That's a great link (which I've seen before) and I upvoted it.
But these "typical JWT lib api vulns" are WAY SIMPLER than Vaudenay etc. Any programmer could do this in minutes or less. WOW. It's so obvious and straightforward (in hindsight I suppose). My mouth is still hanging open.
- bbrazil 12y agoWe've recently been looking at adding JWT, and one of the things I looked out for was that we were protected against downgrade attacks. This was done both as a check of the current library code, and an explicit check on our side that the alg is what we expect to protect against future library changes.