Comments (7)
Given 6 examples, which one you concern as invalid behavior?
from jose2go.
My assumption was that ANY change whatsoever (replacement, addition, deletion, etc) of the token string should render it invalid. Am I wrong?
from jose2go.
which gives only token1 and token2 examples? As far as i can see rest are failed as expected?
from jose2go.
Correct.
Incidentally, while trying to break this I made a testbed dealing with strings, bytes, runes, etc. for length, replacement of chars in the token and so on. I'm not finished with it yet, stuck in where the error "jwt.Decode() expects token of 3 or 5 parts, but was given: 4 parts" is coming from. I'll get back to this tomorrow.
from jose2go.
Okay, let answer one by one:
- 3 or 5 parts is simple. JWT token consists of several parts separated by comma '.', Signed tokens - 3 parts, encrypted - 5. 4 parts is not defined by spec, so it generates error.
- I see sometimes you get panic, sometimes error. Sounds inconsistent to me. As i mentioned is other issue, i think i redo to produce error always (don't panic ;)
- About your alter characters issue. This is base64 decoding thing. You are altering last part of token (AuthTag)
Q_U_HxdpjD_PAP0Tpsqf0w
. And base64 decoding produces same results for altered strings. You can convince yourself by running next sample:
package main
import (
"fmt"
"github.com/dvsekhvalnov/jose2go/arrays"
"github.com/dvsekhvalnov/jose2go/base64url"
)
func main() {
sig0 := "Q_U_HxdpjD_PAP0Tpsqf0w"
sig1 := "Q_U_HxdpjD_PAP0Tpsqf0x"
sig2 := "Q_U_HxdpjD_PAP0Tpsqf0y"
fmt.Printf("len(sig0) % 4=%v\n", len(sig0)%4)
data0, _ := base64url.Decode(sig0)
data1, _ := base64url.Decode(sig1)
data2, _ := base64url.Decode(sig2)
fmt.Printf("\ndata0=%v\n", arrays.Dump(data0))
fmt.Printf("\ndata1=%v\n", arrays.Dump(data1))
fmt.Printf("\ndata2=%v\n", arrays.Dump(data2))
}
and for explanation see http://stackoverflow.com/questions/29941270/why-do-base64-decode-produce-same-byte-array-for-different-strings
from jose2go.
Yes, that's exactly where I was going with my own conclusion, thanks for the clarity and proof. I tried to break it at various points and with diff chars along the length of the token string, the end padding zone was the most fertile problem part. :)
As I said previously I tried to treat the generated token as base64 but that failed.
_, err := base64.StdEncoding.DecodeString(tokenString)
from jose2go.
I think it is safe to close. Fixed token parsing to return error instead of panic.
from jose2go.
Related Issues (20)
- Panic on jwt/jws verify/decrypt with bad JSON headers HOT 7
- Magic panic on Decode() HOT 7
- decode but not vertify HOT 6
- Decode without verifying HOT 2
- Security vulnerabilities HOT 3
- Decryption of Nimbus JWE using RSA 4096 bit fails HOT 11
- GCM - PANIC - incorrect nonce length HOT 2
- Remove the base64url package HOT 1
- How to decode zip DEFLATE compression token? HOT 16
- Go 1.15: broken PBSE2 KDF HOT 5
- Getting error expected key of size 256 bits, but was given 344 bits HOT 1
- Missing tag for 1.4 and 1.5 HOT 8
- Possible to get token.Header["alg"] for JWT vulnerability? HOT 8
- Billion hashes attack against Decode function HOT 6
- [Vuln] JWT bomb Attack in decode function HOT 4
- Illegal token detection before jose.Decode() HOT 11
- Tag for 1.2? HOT 4
- Constant overflows int while building Docker Notary HOT 2
- jose.Sign() does ignore jose.Zip(...) option HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jose2go.