Description

Detects disabled or misconfigured token validation checks in C# applications. This security issue occurs when token validation mechanisms are improperly configured or disabled, which could allow attackers to bypass authentication controls using manipulated or invalid tokens.

Detection Strategy

• Identifies token validation configurations in C# code

• Checks for disabled or weakened token validation settings in authentication setup

• Looks for missing required validation parameters in token validation configurations

• Examines JWT token validation settings in authentication middleware

• Identifies code that disables signature validation or token expiration checks

Vulnerable code example

using Microsoft.IdentityModel.Tokens;

public class JwtConfig 
{
    public void ConfigureTokenValidation() 
    {
        var parameters = new TokenValidationParameters
        {...

✅ Secure code example

using Microsoft.IdentityModel.Tokens;
using System;

public class JwtConfig 
{
    public void ConfigureTokenValidation() 
    {
        var parameters = new TokenValidationParameters...