For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/insecure-jwt.md. A documentation index is available at /llms.txt.

Verify JWT signatures properly

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/insecure-jwt

Language: Dart

Severity: Error

Category: Security

CWE: 347

Description

Calling JWT.decode() skips signature verification entirely, allowing any token to be accepted without checking its authenticity. Similarly, including JWTAlgorithm.none in allowed algorithms disables signature verification, enabling an attacker to forge arbitrary claims including user identity and roles.

Always use JWT.verify() with a strong signing key and never include JWTAlgorithm.none in the allowed algorithms.

Non-Compliant Code Examples

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT trustToken(String token) {
  // Skips signature verification entirely
  return JWT.decode(token);
}

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT acceptNone(String token) {
  return JWT.verify(
    token,
    SecretKey('secret'),
    allowedAlgorithms: [JWTAlgorithm.none],
  );
}

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

void process(String token) {
  final decoded = JWT.decode(token);
  final risky = JWT.verify(token, SecretKey('s'), allowedAlgorithms: [JWTAlgorithm.none]);
}

Compliant Code Examples

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT validateToken(String token) {
  return JWT.verify(token, SecretKey('strongSecretKey'));
}

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

JWT validateToken(String token, RSAPublicKey publicKey) {
  return JWT.verify(token, RSAPublicKey(publicKey));
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security

Datadog Code Security