Skip to main content

Insecurely generated token - Validation

Need​

Secure token generation and validation

Context​

  • Usage of Ruby 2.7 for Ruby programming and development
  • Usage of JWT for secure authentication and authorization
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class UsersController < ApplicationController
  def create
    token = params[:token]
    decoded_token = JWT.decode(token, nil, false)
    if decoded_token
      user = User.new(user_params)
      if user.save
        render json: { status: 'User created successfully' }, status: :created
      else
        render json: { errors: user.errors.full_messages }, status: :bad_request
      end
    end
  else
    render json: { error: 'Invalid token' }, status: :unauthorized
  end

  private

  def user_params
    params.require(:user).permit(:name, :email, :password, :password_confirmation)
  end
end

The above code snippet is a simple user creation endpoint in a Ruby on Rails application. The application is using JWT (JSON Web Tokens) to handle authentication. The problem lies in the way the JWT token is being decoded.

The JWT.decode method is called with nil as the secret key and false for the verify argument. This means that the token is being decoded without any verification of the signature. This leaves the system vulnerable to an attack where a malicious user can modify the token header to change the algorithm used for encryption to 'none'. This would result in the server accepting any token as valid, as long as it is correctly formatted.

This vulnerability can be exploited by an attacker to create users with arbitrary data, bypassing any server-side checks or restrictions that might be in place. This could potentially lead to unauthorized access, data corruption, or even data loss.

Steps​

  • Implement proper validation of the token used for user creation.
  • Ensure that the token is securely generated and cannot be modified by the user.
  • Use a secure encryption algorithm to sign the token to prevent tampering.
  • Verify the signature of the token to ensure its integrity.
  • Handle invalid tokens appropriately, such as returning an error response.
  • Consider using a library or framework-provided functionality for token validation and authentication.

Compliant code​

class UsersController < ApplicationController
  def create
    token = params[:token]
    secret_key = Rails.application.secrets.secret_key_base
    begin
      decoded_token = JWT.decode(token, secret_key, true, { algorithm: 'HS256' })
      user = User.new(user_params)
      if user.save
        render json: { status: 'User created successfully' }, status: :created
      else
        render json: { errors: user.errors.full_messages }, status: :bad_request
      end
    rescue JWT::DecodeError
      render json: { error: 'Invalid token' }, status: :unauthorized
    end
  end

  private

  def user_params
    params.require(:user).permit(:name, :email, :password, :password_confirmation)
  end
end

The updated code now includes a secret key to decode the JWT token and also specifies the algorithm to be used for decoding. This ensures that the token is securely generated and cannot be modified by the user.

The JWT.decode method now has true as its third argument, which means it will verify the integrity of the token. The { algorithm: 'HS256' } argument specifies the algorithm to be used for decoding, which is HMAC SHA256 in this case.

The rescue JWT::DecodeError block handles the case where the token is invalid. If the token cannot be decoded, it means it's invalid, and an error response is returned.

This way, the system properly validates the token used for user creation, uses a secure encryption algorithm to sign the token, verifies the signature of the token, and handles invalid tokens appropriately.

References​

Last updated on