Description

This detector identifies JWT (JSON Web Token) implementations in Rust code where signature verification has been disabled or bypassed. When JWT signature verification is disabled, attackers can forge tokens with arbitrary claims, potentially leading to authentication bypass and unauthorized access to protected resources.

Detection Strategy

• Reports vulnerabilities when the 'jsonwebtoken' library is imported in a Rust file

• Identifies calls to legacy functions that disable JWT signature verification

• Detects dangerous JWT decode operations that bypass signature validation

• Excludes test files from analysis to reduce false positives

• Only analyzes files that import the jsonwebtoken library to focus on relevant code

Vulnerable code example

use actix_web::{get, HttpRequest, HttpResponse};
use jsonwebtoken::{decode, DecodingKey, TokenData, Validation, Algorithm};
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,...

✅ Secure code example

use actix_web::{get, HttpRequest, HttpResponse};
use jsonwebtoken::{decode, DecodingKey, TokenData, Validation, Algorithm};
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,...