php-jwt

https://github.com/tvondra/jwt_context/blob/10be23c0651f1099... https://github.com/tvondra/jwt_context/blob/10be23c0651f1099... https://github.com/tvondra/jwt_context/blob/10be23c0651f1099... Oh look, the typical setup for a classical JWT vulnerability. Prior art: https://auth0.com/blog/critical-vulnerabilities-in-json-web-... https://github.com/firebase/php-jwt/issues/351 You should really consider not using JWT for new designs that don't a priori need to interop with JWT. PASETO is less likely to create sadness: https://paseto.io

The vulnerability is usually in verifiers rather than signers. See, for example: https://github.com/firebase/php-jwt/issues/351

> Blame the library, or its defaults. Every JWT proponent says that, but it's a misuse that shows up in multiple libraries, in multiple languages, and isn't explicitly called out in the JWT Best Practices RFC at all. I'm going to blame the standard for being error-prone. There's nothing in any JWT RFC, to date, that calls out the need for cryptographic keys to be the raw key material in addition to its parameter choices, rather than just the raw key material. That's a fault of the standard. That's not a single library's fault. That's the standard's fault. PASETO has this to say: https://github.com/paseto-standard/paseto-spec/blob/master/d... > As for the key ID attack, this sounds like it's just a trick to know where the private key is located? It shouldn't be publicly accessible. This doesn't involve private keys at all. Look at the proo

> Why all the hate for JWTs? > Just pick a crypto scheme and the JWT is just an encoding that makes it easier to use. That's not what JWT is, but I can understand why someone would be misled into believing that. JWT isn't just an encoding format, it also includes a crypto algorithm negotiation protocol that lets the attacker choose the algorithm. Even if you strictly allow-list which algorithm you want to support, you can accidentally bypass this control in many libraries if you support the `kid` (key ID) header. [1] It also allows attackers to completely strip the security. [2] [3] Put shortly, JWT is a gun aimed directly at your foot. That's why there's so much hate for JWTs. [1] https://github.com/firebase/php-jwt/issues/351 [2] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... [3] https://www.howmanydayssinceajwtalgnonev

They list the php-jwt library from firebase as vulnerable but I can't see why. As far as I can see they do not support the None algorithm. https://github.com/firebase/php-jwt/blob/master/Authenticati... It's not in the methods array and the decode method specifically does a check to see if it's empty. if (empty($header->alg)) { throw exception } Can anyone throw some light on this?