Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Messed up security when using different Alg than HS256 #52

Closed
hmic opened this issue Apr 28, 2017 · 0 comments
Closed

Messed up security when using different Alg than HS256 #52

hmic opened this issue Apr 28, 2017 · 0 comments

Comments

@hmic
Copy link
Contributor

hmic commented Apr 28, 2017

As the config array get merged (deep):
If you specify allowedAlgs => ['RS256'], you end up with allowedAlgs beeing set to ['HS256', 'RS256'], which is NOT the intended result and causes an attacker to be able to alter the Token and create a good signature with just the public key!
hmic added a commit to hmic/cakephp-jwt-auth that referenced this issue Apr 28, 2017
@hmic
Fix ADmad#52
9e4969e 
Only add the default Alg HS256 if none are provided in the custom config, the array gets merged deep, so any default value set will be available whatever gets set from the config (in addition to it).
This is a serve security thread: When setting RS256 it's possible to make up a new token with the public key only that would verify with the HS256 algo!
@ADmad ADmad closed this as completed in 4638e9d May 31, 2017
ADmad added a commit that referenced this issue May 31, 2017
@ADmad
Ensure allowed algorithms list is overwritten instead of merged.
a9c7317 
Closes #52, #54.
ADmad added a commit that referenced this issue May 31, 2017
@ADmad
Ensure allowed algorithms list is overwritten instead of merged.
c87d7c4 
Closes #52, #54.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@hmic