OWASP API2:2023 · CWE-347 · Cryptographic JWT Guard

JWT Token Security & Algorithm Pinning Verifier

Verifies asymmetric RS256/ES256 key pinning, rejects `alg: none` and HMAC/RSA confusion, and validates `exp`, `iss`, and `aud` claims.

View Z3 Claim CLAIM-API-02

Vulnerable Verifier (`services/auth/middleware/jwt_guard.py:L28`)

# API-002 (CONFIRMED): Accepts alg:none tokens
def verify_bearer(token: str):
    # Missing algorithms=['RS256'] allowlist!
    payload = jwt.decode(
        token,
        options={"verify_signature": False}
    )
    return payload

Verified Remediation (RS256 Pinning + Claim Invariants)

# Enforces asymmetric RS256 and strict claim validation
def verify_bearer_strict(token: str, jwks_pem: str):
    return jwt.decode(
        token,
        jwks_pem,
        algorithms=["RS256"],
        audience="https://api.acme.com",
        issuer="https://auth.acme.com",
        options={"require": ["exp", "iss", "aud", "sub"]},
    )