JWT issuer/audience claim validation disabled
ID |
vbnet.authentication.jwt_missing_claim_validation |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Authentication |
Language |
VB.NET |
Description
JWT validation is configured with ValidateIssuer = False or ValidateAudience = False, so tokens minted by an untrusted issuer or intended for a different audience are accepted. This allows token confusion and impersonation attacks. Leave ValidateIssuer and ValidateAudience at their secure default (True) and configure the expected ValidIssuer(s) and ValidAudience(s).
Rationale
JWT validation is configured with ValidateIssuer = False or ValidateAudience = False, so tokens minted by an untrusted issuer or intended for a different audience are accepted. This allows token confusion and impersonation attacks. Leave ValidateIssuer and ValidateAudience at their secure default (True) and configure the expected ValidIssuer(s) and ValidAudience(s).
The following code illustrates a vulnerable pattern detected by this rule:
Public Function BuildParamsAssign() As TokenValidationParameters
Dim opts = New TokenValidationParameters()
' VULNERABLE: JWT issuer/audience claim validation disabled
opts.ValidateIssuer = False
' VULNERABLE: JWT issuer/audience claim validation disabled
opts.ValidateAudience = False
Return opts
End Function