5 ms·
Agreed. Unfortunately, some implementations missed that: https://github.com/namshi/jose/commit/127b4415e66d89b1fcfb5a07933db0b5ff5cd636 https://github.com/nam
by timmclean 12y ago
Agreed. Unfortunately, some implementations missed that:
https://github.com/namshi/jose/commit/127b4415e66d89b1fcfb5a07933db0b5ff5cd636 https://github.com/namshi/jose/commit/127b4415e66d89b1fcfb5a...
https://github.com/davedoesdev/python-jwt/commit/5ddb71b2ed5785c329b761e45a246996a1dd9cab https://github.com/davedoesdev/python-jwt/commit/5ddb71b2ed5...
- zaroth 12y agoVery good catch. You should file CVEs for these, since it's about as hair-on-fire bad as a security bug can be! News at 5: Library for securing tokens doesn't secure tokens.
- davedoesdev 12y agoThanks for spotting this Tim, I appreciate it. I've patched python-jwt and linked to your article. Please let me know if you file a CVE so I can link to it too. The docs did say: returns: ``(header, claims)`` if the token was verified successfully. The token must pass the following tests: - Its signature must verify using the public key or its algorithm must be ``none``. but passing the responsibility for checking header['alg'] to the caller was the wrong way round so thanks again!