Fix JWT Vulnerabilities (Weak Signing, None Algo) in Fastify
JWT implementation in Fastify is often the weakest link. Attackers exploit weak secrets or 'none' algorithm support to forge tokens and escalate privileges. If you aren't explicitly hardening your @fastify/jwt config, you're leaving the door wide open for signature bypass and offline brute-force attacks.
The Vulnerable Pattern
const fastify = require('fastify')();// VULNERABILITY 1: Weak, hardcoded secret (easily cracked via Hashcat) fastify.register(require(‘@fastify/jwt’), { secret: ‘secret123’ });
fastify.get(‘/protected’, async (request, reply) => { // VULNERABILITY 2: No algorithm enforcement allows ‘none’ or ‘HS256’ vs ‘RS256’ confusion try { await request.jwtVerify(); return { user: request.user }; } catch (err) { reply.send(err); } });
The Secure Implementation
The 'none' algorithm vulnerability allows an attacker to bypass authentication by setting the 'alg' header to 'none' and stripping the signature. By default, many libraries might accept this if not explicitly restricted. To remediate: 1. Always pass a 'verify' object with an 'algorithms' array to @fastify/jwt to ensure only your intended signing method (e.g., HS256 or RS256) is accepted. 2. Use a secret with at least 256 bits of entropy to prevent offline brute-force attacks. 3. Validate standard claims like 'iss' (issuer) and 'aud' (audience) to prevent token reuse across different services.
const fastify = require('fastify')(); const fs = require('fs');fastify.register(require(‘@fastify/jwt’), { // SECURE: Use a high-entropy secret from env or asymmetric keys secret: process.env.JWT_STRONG_SECRET, verify: { // SECURE: Explicitly whitelist allowed algorithms to kill ‘none’ attacks algorithms: [‘HS256’], // SECURE: Enforce standard claims for stricter validation allowedIss: ‘my-app-auth’, allowedAud: ‘my-app-api’ } });
fastify.addHook(‘onRequest’, async (request, reply) => { try { await request.jwtVerify(); } catch (err) { reply.code(401).send({ error: ‘Invalid Token’ }); } });
Your Fastify API
might be exposed to JWT Vulnerabilities (Weak Signing, None Algo)
74% of Fastify apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.