Skip to main content

Lack of data validation - Token

Need​

Implementation of robust token validation and signature verification

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of Microsoft.AspNetCore.Authentication.JwtBearer for JWT-based authentication in ASP.NET Core
  • Usage of Microsoft.Extensions.DependencyInjection for Dependency Injection in .NET applications
  • Usage of Microsoft.IdentityModel.Tokens for handling authentication and token-based security

Description​

Non compliant code​

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = false,
                ValidateIssuer = false,
                ValidateAudience = false,
            };
        });
    }
}

In the above C# code snippet, the JWT token is being used for authentication in an ASP.NET Core application. However, the token validation parameters are set to false, meaning the application does not validate the JWT token's signature, issuer, or audience.

The ValidateIssuerSigningKey parameter is set to false, which means the application does not validate the JWT token's signature. This allows an attacker to modify the token or even remove the signature, and the application would still accept the token as valid.

Similarly, the ValidateIssuer and ValidateAudience parameters are also set to false. This means the application does not validate if the token was issued by a trusted issuer or if the token is intended for the current application.

This lack of data validation makes the application vulnerable to attacks. An attacker could forge a token, modify an existing token, or remove the signature from a token, and the application would still accept these as valid tokens. This could lead to unauthorized access or other security issues.

Steps​

  • Enable signature validation for the JWT access token.
  • Validate the issuer of the token to ensure it is trusted.
  • Validate the audience of the token to ensure it is intended for the correct recipient.
  • Consider using a secure key for signing and verifying the token.
  • Implement proper error handling for token validation failures.

Compliant code​

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidIssuer = "YourIssuer", // Replace with your token issuer
                ValidAudience = "YourAudience", // Replace with your intended audience
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("YourSigningKey")) // Replace with your signing key
            };
        });
    }
}

The original code had a vulnerability due to the lack of validation for the JWT access token. The token was not validating if the signature was valid, which means the token could be modified and requests would still be accepted. Even removing the signature from the token would work.

The updated code fixes this vulnerability by enabling signature validation for the JWT access token. This is done by setting ValidateIssuerSigningKey to true in the TokenValidationParameters.

In addition, the issuer of the token is now validated to ensure it is trusted. This is done by setting ValidateIssuer to true and specifying a ValidIssuer.

The audience of the token is also validated to ensure it is intended for the correct recipient. This is done by setting ValidateAudience to true and specifying a ValidAudience.

A secure key is used for signing and verifying the token. This is done by setting IssuerSigningKey to a new SymmetricSecurityKey.

Proper error handling for token validation failures should also be implemented to ensure security. This is not shown in the code snippet, but it is an important part of securing the application.

References​

Last updated on