Avoid disabling JWT signature verification

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST Rules > Avoid disabling JWT signature verification

Metadata

ID: rust-security/jwt-insecure-decode

Language: Rust

Severity: Warning

Category: Security

CWE: 347

Description

Calling dangerous::insecure_decode() or Validation::insecure_disable_signature_validation() from the jsonwebtoken crate bypasses JWT signature verification entirely. The token’s claims are decoded and accepted without checking the signature, so an attacker can forge any token by editing the payload and re-encoding it. Always validate signatures with a strong algorithm such as RS256, ES256, or HS256.

Learn More

CWE-347: Improper Verification of Cryptographic Signature

Non-Compliant Code Examples

use jsonwebtoken::{Algorithm, Validation};

fn invalid(token: &str) -> Result<(), Box<dyn std::error::Error>> {
    // Unqualified dangerous::insecure_decode
    let _ = dangerous::insecure_decode::<serde_json::Value>(token)?;

    // Fully qualified
    let _ = jsonwebtoken::dangerous::insecure_decode::<serde_json::Value>(token)?;

    // Method form on a fresh Validation
    let _ = Validation::new(Algorithm::HS256).insecure_disable_signature_validation();

    // Method form on a variable
    let mut validation = Validation::new(Algorithm::HS256);
    validation.insecure_disable_signature_validation();

    Ok(())
}

Compliant Code Examples

use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};

fn valid(token: &str, key: &DecodingKey) -> Result<(), Box<dyn std::error::Error>> {
    // Normal verifying decode where signature is checked
    let validation = Validation::new(Algorithm::HS256);
    let _ = decode::<serde_json::Value>(token, key, &validation)?;

    // A regular `decode` call (not the dangerous module)
    let _ = jsonwebtoken::decode::<serde_json::Value>(token, key, &validation)?;

    Ok(())
}