Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful
Tired: {"alg":"none"}Wired: {"alg":"nonE"}The JOSE standards (including JWT) are a gift that keeps on giving to attackers.I designed an alternative format in 2018 called PASETO, which doesn't contain the JOSE foot-guns. (I'm pushing for an IETF RFC this year.)https://paseto.ioEDIT: Also, this affected their Authentication API rather than their JWT library.If you use their JWT library, well, it certainly allows this kind of horrendous misuse... but it is not, per se, vulnerable.