Endpoint accepts unsigned JWT

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

This publicly exposed API endpoint accepts unsigned JWTs. The JWT specification allows for unsecured JWTs where the algorithm is set to “none” and no signature is provided.

When an endpoint accepts JWTs with the “none” algorithm, it means that:

  1. No cryptographic signature verification is performed
  2. The JWT payload is trusted without any authentication of its integrity
  3. Anyone can create a valid JWT by simply setting the algorithm to “none” and removing the signature

Remediation

To fix this vulnerability, reject unsigned JWTs: Configure your JWT validation library to explicitly reject JWTs with "alg": "none". If that’s not possible, manually review the parsed JWT and reject it if the algorithm is none.