Does spring security JWT implementation deal with alg:none attack? [closed] - spring

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Closed 3 years ago.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Improve this question
JWT implementations might be exposed to different attacks, one of them is the alg:none attack (see more details here).
I'm using spring-security-jwt dependency in my pom.xml file, and was not able to find out whether this implementation deals with the alg:none attack.
Is this attack mitigated by the spring security JWT implementation?

Answer 1

If you are using spring-security-oauth/spring-security-jwt then yes, This attack is mitigated. As per the link you have shared, one way to mitigate this attack is by considering a JWT token with header with "alg":"none" as invalid or not rely on the alg header when selecting the algorithm.
In the source code for spring-security-jwt file JwtHelper in the decode method does not rely on the alg header when selecting the algorithm.
public static Jwt decode(String token) {
int firstPeriod = token.indexOf('.');
int lastPeriod = token.lastIndexOf('.');
if (firstPeriod <= 0 || lastPeriod <= firstPeriod) {
throw new IllegalArgumentException("JWT must have 3 tokens");
}
CharBuffer buffer = CharBuffer.wrap(token, 0, firstPeriod);
// TODO: Use a Reader which supports CharBuffer
JwtHeader header = JwtHeaderHelper.create(buffer.toString());
buffer.limit(lastPeriod).position(firstPeriod + 1);
byte[] claims = b64UrlDecode(buffer);
boolean emptyCrypto = lastPeriod == token.length() - 1;
byte[] crypto;
if (emptyCrypto) {
if (!"none".equals(header.parameters.alg)) {
throw new IllegalArgumentException(
"Signed or encrypted token must have non-empty crypto segment");
}
crypto = new byte[0];
}
else {
buffer.limit(token.length()).position(lastPeriod + 1);
crypto = b64UrlDecode(buffer);
}
return new JwtImpl(header, claims, crypto);
}
There is no document or compilation of vulnerabilities in spring-security-jwt but you can check the issues section under spring-security-jwt and report any vulnerabilities you think which needs to be patched.