This rule helps maintain the integrity and security of JSON Web Tokens (JWTs) in your Kotlin applications. JWTs are often used for authentication and information exchange, which makes them a prime target for malicious attacks. Using the none algorithm in JWT creation means that the tokens are not signed or validated, which can lead to token forgery and unauthorized access to sensitive data.
This rule is important because an attacker can modify the token payload when the algorithm is none. In this case, because there is no signature to verify that the content was not tampered with, the attacker can impersonate any user. This can lead to serious security breaches.
To adhere to this rule, always use a secure algorithm when creating JWTs. For instance, use HMAC combined with SHA-256 (HMAC256). This ensures that the tokens are signed and validated, preventing token forgery. Additionally, handle exceptions properly to ensure your application can respond effectively to any JWT creation errors.
Non-Compliant Code Examples
// Non-compliant: Using 'none' algorithm which allows token forgery
funcreateUnsafeJwtToken(issuer:String):String{try{// WARNING: This allows attackers to forge tokens
valalgorithm=Algorithm.none()returnJWT.create().withIssuer(issuer).sign(algorithm)}catch(e:JWTCreationException){throwSecurityException("Failed to create JWT token",e)}}
Compliant Code Examples
// Compliant: Using secure HMAC256 algorithm
funcreateSecureJwtToken(issuer:String,secretKey:String):String{try{// Secure algorithm with proper key
valalgorithm=Algorithm.HMAC256(secretKey)returnJWT.create().withIssuer(issuer).withIssuedAt(Date()).sign(algorithm)}catch(e:JWTCreationException){throwSecurityException("Failed to create JWT token",e)}}
シームレスな統合。 Datadog Code Security をお試しください
Datadog Code Security
このルールを試し、Datadog Code Security でコードを解析する
このルールの使用方法
1
2
rulesets:- kotlin-security # Rules to enforce Kotlin security.