Description

Detects unsafe JWT token signing practices in Scala applications where tokens are created without proper cryptographic signing. Unsigned or improperly signed JWTs can be tampered with by attackers, potentially allowing unauthorized access or privilege escalation.

Detection Strategy

• Identifies calls to the 'compact' method on JWT builder instances

• Checks if the JWT builder instance was configured without proper signing mechanisms

• Reports a vulnerability when a JWT token is generated (via compact()) without proper cryptographic signatures

Vulnerable code example

import io.jsonwebtoken.Jwts

class JwtExample {
    def createInsecureToken(): String = {
        // Vulnerable: JWT token created without signature/secret key
        Jwts.builder()
            .setSubject("user")
            .compact()...

✅ Secure code example

import io.jsonwebtoken.Jwts
import io.jsonwebtoken.SignatureAlgorithm
import javax.crypto.spec.SecretKeySpec
import java.util.Base64

class JwtExample {
    private val secretKey = generateSecretKey() // Store securely, don't hardcode
...