Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful
Tired: {"alg":"none"}<p>Wired: {"alg":"nonE"}<p>The JOSE standards (including JWT) are a gift that keeps on giving to attackers.<p>I designed an alternative format in 2018 called PASETO, which doesn't contain the JOSE foot-guns. (I'm pushing for an IETF RFC this year.)<p><a href="https://paseto.io" rel="nofollow">https://paseto.io</a><p>EDIT: Also, this affected their Authentication API rather than their JWT library.<p>If you use their JWT library, well, it certainly <i>allows</i> this kind of horrendous misuse... but it is not, per se, vulnerable.