Description

This detector identifies JWT tokens that are signed with empty or missing passwords/secrets in JavaScript applications using the jsonwebtoken library. When JWT tokens are signed without a proper secret, they can be easily forged by attackers, completely undermining the authentication and authorization security provided by JWTs.

Detection Strategy

• Identifies imports or usage of the 'jsonwebtoken' library in JavaScript code

• Locates calls to the JWT signing function (typically 'jwt.sign' or similar based on import alias)

• Analyzes the parameters passed to the signing function to detect missing, empty, or null secret values

• Reports vulnerability when JWT signing is performed without a proper secret parameter

Vulnerable code example

const jwt = require('jsonwebtoken');

function vulnerableJwtEmptySecret() {
    const token = jwt.sign(
        { user: "admin" },
        "" // Vulnerable: empty secret allows token forgery
    );
    return token;...

✅ Secure code example

const jwt = require('jsonwebtoken');

function secureJwtWithSecret() {
    const token = jwt.sign(
        { user: "admin" },
        process.env.JWT_SECRET || "fallback-secret-key-123!" // Safe: use environment variable with fallback
    );
    return token;...