Skip to main content

Insecurely generated token - Validation

Need​

Secure token generation and validation

Context​

  • Usage of TypeScript for type-checking and compiling JavaScript code
  • Usage of Express for building web applications and APIs
  • Usage of jsonwebtoken for generating and verifying JSON Web Tokens (JWT)

Description​

Non compliant code​

import express from 'express';
import jwt from 'jsonwebtoken';

const app = express();

app.post('/createUser', (req, res) => {
  const { username, email } = req.body;

  // Insecurely generate token without proper validation
  const token = jwt.sign({ username, email }, 'insecureSecret');

  res.json({ token });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in this code lies in the insecure generation of the token used for user creation. The token is generated using the jwt.sign function from the jsonwebtoken library. However, there is no proper validation of the token or its header.

The issue is that the code does not validate the algorithm used for token encryption. The algorithm is not explicitly specified, so the default algorithm is used. This means that an attacker can modify the header of the token to specify a different algorithm, such as "none", which effectively disables the token signature.

By modifying the algorithm to "none", an attacker can create users within the application with tokens that are not properly signed. This can lead to unauthorized access and potential security breaches.

To fix this vulnerability, the code should include proper validation of the token header to ensure that the algorithm used for encryption is secure and not easily tampered with.

Steps​

  • Validate the token before using it
  • Use a secure secret for signing the token
  • Consider using a stronger encryption algorithm for the token

Compliant code​

import express from 'express';
import jwt from 'jsonwebtoken';

const app = express();

app.post('/createUser', (req, res) => {
  const { username, email } = req.body;

  // Securely generate and validate the token
  const secret = 'secureSecret';
  const algorithm = 'HS256';
  const token = jwt.sign({ username, email }, secret, { algorithm });

  res.json({ token });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The fixed code addresses the vulnerability by securely generating and validating the token used for user creation. Here's an explanation of the changes made:

  1. The code imports the necessary modules, express and jsonwebtoken, to handle the server and token generation/validation, respectively.

  2. The app variable is initialized as an instance of the express application.

  3. The app.post('/createUser', ...) route handles the POST request to create a new user. It expects the username and email to be provided in the request body.

  4. The token generation and validation process has been updated to address the vulnerability. The secret variable holds a secure secret key used for signing the token. It should be kept confidential and not exposed in the code.

  5. The algorithm variable is set to 'HS256', which specifies the HMAC-SHA256 algorithm for signing the token. This ensures the token is properly signed and cannot be modified by an attacker.

  6. The jwt.sign(...) function is used to generate the token. It takes the payload, secret, and options (including the algorithm) as arguments.

  7. The generated token is sent back as a JSON response to the client.

  8. The server listens on port 3000 for incoming requests.

By securely generating and validating the token using a secret key and a specified algorithm, the fixed code prevents an attacker from modifying the token's signature and creating users with unsigned tokens.

References​

Last updated on