node-jsonwebtoken

I've raised a PR to rename decode() to unsafeDecode() (removing it from the public API might be a hard sell). I really have no idea why this is part of the public API. https://github.com/auth0/node-jsonwebtoken/pull/741

This exact vulnerability is something I've seen in a good number of open-source codebases or boilerplate repos in the Node ecosystem. The library most people use for JWT stuff in Node is Auth0's. There are two methods for decoding a token payload: jwt.decode() and jwt.verify() Both of them return the decoded payload, but one (if you don't read the documentation) sounds more immediately like the one you think you want to use. jwt.decode() doesn't verify the token when decoding: https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--o... If you dig through Node repos on Github searching for "jwt.decode()" or "this.jwtService.decode()" you'll see a shocking number of results. The other big mistake I've seen is encoding personal data in the token, instead of just an ID that only has meaning inside of your database. It turns out not everyo

If you don't set it it's set to a reasonable list of algorithms [0], which doesn't include "none" https://github.com/auth0/node-jsonwebtoken/blob/master/verif...

https://github.com/auth0/node-jsonwebtoken/blob/5f10bf9957a2... The end result depends entirely on the behavior of JavaScript's Array.indexOf() implementation.