1. Executive Summary & Scope
JSON Web Tokens (JWT) are widely used for stateless API authentication. Flaws in token validation libraries—such as accepting unsigned tokens (`alg: none`), confusing symmetric (HMAC) and asymmetric (RSA/ECDSA) keys, or failing to enforce expiration (`exp`)—enable attackers to forge arbitrary identities.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-347 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
An attacker tampers with the token payload to set `"role": "admin"`, changes the header algorithm to `"none"` or signs with the public key against an HMAC verifier, bypassing authentication entirely.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Decoding without explicit algorithm pinning or signature check
$token = $_SERVER['HTTP_AUTHORIZATION'];
$jwt = JWT::decode($token, $publicKey, []); // Insecure: algorithm parameter omitted or dynamic
Hardened Defense-in-Depth Implementation
// REMEDIATED: Strict algorithm whitelist, key separation, and clock skew allowance
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
try {
$token = extract_bearer_token();
// Strictly specify allowed key instance and expected asymmetric algorithm
$decoded = JWT::decode($token, new Key($publicKeyPem, 'RS256'));
// Explicit assertion on issuer and audience claims
if ($decoded->iss !== 'https://auth.webotg.com' || $decoded->aud !== 'webotg-api') {
throw new \Exception("Invalid token claims");
}
} catch (\Exception $e) {
http_response_code(401);
die(json_encode(['error' => 'Unauthorized: Invalid or expired token']));
}
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Alg: None Injection | Submit token with header `{"alg":"none","typ":"JWT"}` with stripped signature. | Server rejects token with 401 Unauthorized. |
| Algorithm Confusion (HMAC vs RSA) | Sign token using RSA public key string as secret key with HS256 algorithm. | Server rejects HS256 algorithm when configured for RS256 public keys. |
| Expired Token Replay | Submit token where `exp` timestamp is 60 seconds in the past. | Server rejects token and requires re-authentication. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.