Fix JWT Vulnerabilities (Weak Signing, None Algo) in Poem
Poem's flexibility means developers often roll their own JWT logic using the `jsonwebtoken` crate. The 'None' algorithm attack and weak secrets remain the top vectors for authentication bypass. If your validation logic is permissive, you're essentially handing out root shells. Secure your implementation by enforcing strict algorithm checks and rotating cryptographically strong keys.
The Vulnerable Pattern
use jsonwebtoken::{decode, DecodingKey, Validation, Algorithm};// VULNERABLE: Allowing ‘None’ algorithm and using a weak, hardcoded secret fn verify_token(token: &str) -> Option
{ let mut validation = Validation::new(Algorithm::HS256); // CRITICAL: This allows attackers to bypass signing by setting ‘alg: none’ in the header validation.algorithms = vec![Algorithm::HS256, Algorithm::None]; decode::<Claims>( token, &DecodingKey::from_secret("secret123".as_ref()), &validation ).ok().map(|data| data.claims)
}
The Secure Implementation
The fix involves three layers of defense: 1. Algorithm Hardening: By explicitly setting `Validation::new(Algorithm::HS256)` and ensuring `Algorithm::None` is never present in the allowed algorithms vector, the library will reject any token where the header claims 'alg: none'. 2. Secret Strength: Moving from a hardcoded string to a high-entropy environment variable prevents credential leakage in source control and makes brute-force attacks against the HS256 signature infeasible. 3. Error Propagation: Using `Result` instead of `Option` ensures that specific validation failures (expired tokens, invalid signatures) can be logged and handled by Poem's middleware to return proper 401 Unauthorized status codes.
use jsonwebtoken::{decode, DecodingKey, Validation, Algorithm}; use std::env;// SECURE: Strict algorithm enforcement and environment-based secrets fn verify_token(token: &str) -> Result<Claims, jsonwebtoken::errors::Error> { // Load high-entropy secret from environment let secret = env::var(“JWT_SECRET”).expect(“JWT_SECRET NOT SET”);
// Explicitly set ONLY the expected algorithm. // jsonwebtoken's Validation::new defaults to HS256 and does NOT include None. let validation = Validation::new(Algorithm::HS256); let token_data = decode::<Claims>( token, &DecodingKey::from_secret(secret.as_ref()), &validation )?; Ok(token_data.claims)
}
Your Poem API
might be exposed to JWT Vulnerabilities (Weak Signing, None Algo)
74% of Poem apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.