feat: adding support for Unsecured JWT without signature algorithm type "none" - #537
feat: adding support for Unsecured JWT without signature algorithm type "none"#537douggynix wants to merge 1 commit into
Conversation
…pe "none" feat: rename None for Serialization feat: adding none as algorithm variant type for Unsecured JWT
|
It's not supported on purpose. Use https://docs.rs/jsonwebtoken/latest/jsonwebtoken/dangerous/fn.insecure_decode.html if you need to handle the "none" case. |
It is still an issue. The issue is with insecure_decode. The serializer always failed when the header field has alg with value none as below {
"alg": "none",
"typ": "JWT"
}Even though you skip validations for with insecure_decode functions, the deserialization is always failing as the enum you use for Algorithm values doesn't have "none" in its list . I guess you may reconsider reopen up this PR as this is a real issue. let token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2huQGVtYWlsLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxNTE2MjM5MDQwLCJhdWQiOlsianNvbndlYnRva2VudGVzdCJdfQ.";
let TokenData { header, claims } = insecure_decode::<Claims>(token).unwrap();
assert_eq!(Some("JWT".to_string()), header.typ);
assert_eq!(vec!["jsonwebtokentest"], claims.aud);
assert_eq!("john@email.com", claims.sub);
assert_eq!(1516239022, claims.iat);
assert_eq!(1516239040, claims.exp);
|
Unsecure JWTs Decoding
Here I add support for decoding JWT with header algorithm set to value "none". The RFC has it specified. But JSONWeb token library didn't support decoding such JWT and would always fail. I added None to the list of variants of Algorithm enums to be able to support unsecure jwt decoding.
Here is the RFC and the section of the pages where this is mentioned as a spec to JWT which jsonwebtoken lib didn't support.

https://datatracker.ietf.org/doc/html/rfc7519#page-12