Fix JWT Vulnerabilities (Weak Signing, None Algo) in Vert.x

Vert.x JWT implementations are frequently pwned via 'none' algorithm bypasses and weak symmetric secrets. If your configuration allows the 'alg' header to dictate verification without strict enforcement or uses a guessable HMAC secret, you're handing over root access. Real-world exploitation involves swapping the header to 'none' or brute-forcing the HS256 key offline. We fix this by enforcing asymmetric signatures and explicitly hardening the provider configuration.

The Vulnerable Pattern

JWTAuthOptions config = new JWTAuthOptions()
  .addPubSecKey(new PubSecKeyOptions()
    .setAlgorithm("HS256")
    .setBuffer("keyboard-cat")); // VULNERABLE: Weak, hardcoded symmetric secret
JWTAuth provider = JWTAuth.create(vertx, config);
// If the incoming token has {“alg”:“none”}, some older Vert.x versions or
// misconfigured handlers might skip signature verification entirely.

The Secure Implementation

1. Kill HS256: Symmetric keys are prone to brute-force and leakage. Switching to RS256 (Asymmetric) ensures that even if the public key is known, tokens cannot be forged without the private key. 2. Algorithm Pinning: By explicitly adding a PubSecKey with RS256, Vert.x's JWTAuth provider will reject tokens using 'none' or 'HS256' because they don't match the configured key type. 3. Environment Secrets: Never hardcode keys. Use `System.getenv()` to pull keys from a secure vault or environment variable. 4. Expiration Enforcement: Always set `setIgnoreExpiration(false)` to prevent long-lived token replay attacks.

JWTAuthOptions config = new JWTAuthOptions()
  .addPubSecKey(new PubSecKeyOptions()
    .setAlgorithm("RS256")
    .setBuffer(System.getenv("JWT_PUBLIC_KEY"))) // SECURE: Use RS256 with environment-loaded Public Key
  .setJWTOptions(new JWTOptions()
    .setIgnoreExpiration(false)
    .setLeeway(30));
JWTAuth provider = JWTAuth.create(vertx, config);
// Ensure the router handler strictly enforces the provider’s logic
router.route(“/api/*“).handler(JWTAuthHandler.create(provider));