Fix JWT Vulnerabilities (Weak Signing, None Algo) in Fresh
JWT handling in Fresh (Deno) is a frequent source of critical vulnerabilities. The two most common vectors are the 'none' algorithm bypass—where an attacker strips the signature and changes the header to 'alg': 'none'—and weak signing keys that are susceptible to offline brute-forcing. If your middleware blindly trusts the 'alg' header or uses a hardcoded secret, your entire authentication layer is effectively non-existent.
The Vulnerable Pattern
import { decode } from "https://deno.land/x/djwt/mod.ts";// VULNERABLE MIDDLEWARE export async function handler(req: Request, ctx: any) { const authHeader = req.headers.get(“Authorization”); const token = authHeader?.split(” ”)[1];
if (!token) return ctx.next();
// CRITICAL FAILURE: decode() does not verify the signature. // An attacker can set ‘alg’: ‘none’ or forge claims. const { payload } = decode(token);
ctx.state.user = payload.sub; return await ctx.next(); }
The Secure Implementation
To secure Fresh apps: 1. Swap 'decode' for 'verify'. The 'verify' function in djwt requires a CryptoKey and will throw an error if the signature is missing or the algorithm is set to 'none'. 2. Algorithm Pinning: By importing the key specifically for HMAC SHA-256, you prevent 'Algorithm Switching' attacks. 3. High Entropy: Use Deno.env.get() to load a secret with at least 256 bits of entropy. Hardcoded secrets in git are a 'game over' scenario. 4. Strict Error Handling: Always catch verification failures and return a 401/403 instead of falling through to the next handler.
import { verify } from "https://deno.land/x/djwt/mod.ts";// SECURE IMPLEMENTATION const encoder = new TextEncoder(); const secretKey = Deno.env.get(“JWT_SECRET”);
if (!secretKey || secretKey.length < 32) { throw new Error(“JWT_SECRET must be at least 32 characters.”); }
const key = await crypto.subtle.importKey( “raw”, encoder.encode(secretKey), { name: “HMAC”, hash: “SHA-256” }, false, [“verify”] );
export async function handler(req: Request, ctx: any) { const authHeader = req.headers.get(“Authorization”); const token = authHeader?.split(” ”)[1];
if (!token) return new Response(“Unauthorized”, { status: 401 });
try { // verify() enforces the algorithm and validates the signature against the CryptoKey const payload = await verify(token, key); ctx.state.user = payload.sub; return await ctx.next(); } catch (err) { return new Response(“Invalid Token”, { status: 403 }); } }
Your Fresh API
might be exposed to JWT Vulnerabilities (Weak Signing, None Algo)
74% of Fresh apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.