JWT token lifetime/expiration validation disabled
ID |
vbnet.cryptography.jwt_missing_expiry_validation |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Cryptography |
Language |
VB.NET |
Description
JWT validation is configured with ValidateLifetime = False or RequireExpirationTime = False, so expired tokens are accepted. This lets a leaked or replayed token be used indefinitely. Leave ValidateLifetime and RequireExpirationTime at their secure default (True).
Rationale
JWT validation is configured with ValidateLifetime = False or RequireExpirationTime = False, so expired tokens are accepted. This lets a leaked or replayed token be used indefinitely. Leave ValidateLifetime and RequireExpirationTime at their secure default (True).
The following code illustrates a vulnerable pattern detected by this rule:
Public Function BuildParamsAssign() As TokenValidationParameters
Dim opts = New TokenValidationParameters()
' VULNERABLE: JWT token lifetime/expiration validation disabled
opts.ValidateLifetime = False
' VULNERABLE: JWT token lifetime/expiration validation disabled
opts.RequireExpirationTime = False
Return opts
End Function