28 lines
815 B
Plaintext
28 lines
815 B
Plaintext
include::../description.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
https://www.npmjs.com/package/jsonwebtoken[jsonwebtoken] library:
|
|
|
|
----
|
|
const jwt = require('jsonwebtoken');
|
|
|
|
let token = jwt.sign({ foo: 'bar' }, key, { algorithm: 'none' }); // Noncompliant: JWT should include a signature
|
|
|
|
jwt.verify(token, key, { expiresIn: 360000 * 5, algorithms: ['RS256', 'none'] }, callbackcheck); // Noncompliant: none algorithm should not be used when verifying JWT signature
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
https://www.npmjs.com/package/jsonwebtoken[jsonwebtoken] library:
|
|
|
|
----
|
|
const jwt = require('jsonwebtoken');
|
|
|
|
let token = jwt.sign({ foo: 'bar' }, key, { algorithm: 'HS256' }); // Compliant
|
|
|
|
jwt.verify(token, key, { expiresIn: 360000 * 5, algorithms: ['HS256'] }, callbackcheck); // Compliant
|
|
----
|
|
|
|
include::../see.adoc[]
|