Description

This detector identifies Ruby JWT tokens used for sessions that lack proper expiration settings. When JWT tokens don't have expiration claims, they remain valid indefinitely, creating security risks if compromised since there's no automatic token invalidation.

Detection Strategy

• The JWT library must be imported in the Ruby code

• A JWT.encode() function call is identified in the code

• The payload (first argument) of the JWT.encode() call is analyzed

• The payload is determined to be session-related but missing expiration claims (exp, iat, or nbf)

• A vulnerability is reported when all these conditions are met: JWT library usage, JWT encoding for sessions, and absence of time-based expiration controls

Vulnerable code example

require 'jwt'

class AuthController < ApplicationController
  SECRET = ENV['JWT_SECRET']

  def login
    payload = { sid: SecureRandom.uuid, user_id: current_user.id } # Missing expiration claim
    token = JWT.encode(payload, SECRET, 'HS256')...

✅ Secure code example

require 'jwt'

class AuthController < ApplicationController
  SECRET = ENV['JWT_SECRET']

  def login
    payload = { sid: SecureRandom.uuid, user_id: current_user.id, exp: 30.minutes.from_now.to_i } # Added expiration claim
    token = JWT.encode(payload, SECRET, 'HS256')...