Fix JWT Vulnerabilities (Weak Signing, None Algo) in Bottle
JWT implementations in Bottle applications often fail due to improper usage of the PyJWT library, specifically allowing the 'none' algorithm or using weak, hardcoded secrets. This allows attackers to forge tokens and escalate privileges. To fix this, we must enforce cryptographic signing and pin the allowed algorithms.
The Vulnerable Pattern
import jwt from bottle import request, routeSECRET_KEY = ‘super_secret’ # Weak/Hardcoded
@route(‘/api/data’) def get_data(): token = request.headers.get(‘Authorization’).split(’ ’)[1] # VULNERABLE: verify_signature=False or missing algorithms parameter allows ‘none’ attack payload = jwt.decode(token, SECRET_KEY, options={‘verify_signature’: False}) return {‘status’: ‘success’, ‘user’: payload.get(‘user’)}
The Secure Implementation
The secure implementation mitigates two primary vectors: 1) Algorithm Confusion/None Attack: By passing 'algorithms=['HS256']', PyJWT will throw an error if the token header specifies 'none' or any other unauthorized algorithm. 2) Weak Secret Brute-forcing: Moving the secret to an environment variable ensures that high-entropy keys are used and not leaked via source control. Additionally, wrap the decode logic in a try-except block to handle malformed tokens gracefully without leaking stack traces.
import jwt
import os
from bottle import request, route, HTTPError
Secure: Load high-entropy secret from environment
SECRET_KEY = os.environ.get(‘JWT_SECRET_KEY’)
ALLOWED_ALGORITHMS = [‘HS256’]
@route(‘/api/data’)
def get_data():
auth_header = request.headers.get(‘Authorization’)
if not auth_header:
raise HTTPError(401, ‘Missing token’)
try:
token = auth_header.split(' ')[1]
# SECURE: Explicitly define algorithms and enable signature verification
payload = jwt.decode(token, SECRET_KEY, algorithms=ALLOWED_ALGORITHMS)
return {'status': 'success', 'user': payload.get('user')}
except (jwt.ExpiredSignatureError, jwt.InvalidTokenError, IndexError):
raise HTTPError(403, 'Invalid or expired token')</code></pre>
Your Bottle API
might be exposed to JWT Vulnerabilities (Weak Signing, None Algo)
74% of Bottle apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.