JWT Simple No Verification

What it is

The Node.js application uses the jwt-simple library to decode JWT tokens without proper signature verification, allowing attackers to forge or tamper with tokens. This vulnerability can lead to authentication bypass, privilege escalation, and unauthorized access to protected resources.

// Vulnerable: JWT decoding without verification
const jwt = require('jwt-simple');

app.get('/protected', (req, res) => {
  const token = req.headers.authorization?.split(' ')[1];
  
  try {
    // Dangerous: No signature verification
    const payload = jwt.decode(token, null, true); // noVerify = true
    
    // Trust unverified token data
    req.user = payload;
    res.json({ message: 'Access granted', user: payload });
  } catch (error) {
    res.status(401).json({ error: 'Invalid token' });
  }
});

// Secure: Proper JWT verification
const jwt = require('jwt-simple');

const JWT_SECRET = process.env.JWT_SECRET;
const ALGORITHM = 'HS256';

if (!JWT_SECRET) {
  throw new Error('JWT_SECRET environment variable required');
}

app.get('/protected', (req, res) => {
  const token = req.headers.authorization?.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }
  
  try {
    // Secure: Verify signature with secret and algorithm
    const payload = jwt.decode(token, JWT_SECRET, false, ALGORITHM);
    
    // Validate token expiration
    if (payload.exp && Date.now() >= payload.exp * 1000) {
      return res.status(401).json({ error: 'Token expired' });
    }
    
    req.user = payload;
    res.json({ message: 'Access granted', userId: payload.sub });
  } catch (error) {
    res.status(401).json({ error: 'Invalid token' });
  }
});

Why it happens

Applications use jwt-simple's decode() function without providing secret key for signature verification: jwt.decode(token, null) or jwt.decode(token, '', null, true) with noVerify flag. Developers misunderstand JWT security model thinking decode() validates tokens when it only parses them. Code extracts user information from JWT payload without verifying the token was actually signed by trusted authority. Attackers craft arbitrary JWT tokens with forged claims (userId, role, permissions) knowing application won't verify signature. Applications trust token contents implicitly allowing complete authentication bypass. This is especially dangerous when JWT contains authorization data like admin flags or user roles that control access to sensitive functionality.

Fixes

Related Vulnerabilities