Description

This detector identifies when sensitive information is included in JWT (JSON Web Token) payloads in JavaScript applications. JWTs are only base64-encoded (not encrypted) and can be easily decoded by anyone, making any sensitive data in the payload visible to attackers who intercept the token.

Detection Strategy

• Identifies imports or usage of the 'jsonwebtoken' library in JavaScript code

• Locates calls to the JWT signing function (typically jsonwebtoken.sign())

• Analyzes the first argument passed to the sign function, which represents the JWT payload

• Triggers when the payload contains sensitive information such as passwords, API keys, personal identifiable information, or other confidential data

• Reports the vulnerability at the location where the JWT sign method is called with unsafe payload data

Vulnerable code example

const jwt = require('jsonwebtoken');
const express = require('express');
const app = express();

app.use(express.json());

app.post('/login', (req, res) => {
    const { username, password } = req.body;...

✅ Secure code example

const jwt = require('jsonwebtoken');
const express = require('express');
const app = express();

app.use(express.json());

app.post('/login', (req, res) => {
    const { username, password } = req.body;...