Files
codeql/javascript/ql/test/query-tests/Security/CWE-347/bad-jwt.js
2022-01-26 09:35:54 +01:00

12 lines
488 B
JavaScript

const jwt = require("jsonwebtoken");
const secret = "my-secret-key";
var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: "HS256" })
jwt.verify(token, secret, { algorithms: ["HS256", "none"] }) // OK
var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: "none" })
jwt.verify(token, "", { algorithms: ["HS256", "none"] }) // NOT OK
jwt.verify(token, undefined, { algorithms: ["HS256", "none"] }) // NOT OK
jwt.verify(token, false, { algorithms: ["HS256", "none"] }) // NOT OK