Description

This vulnerability detector identifies JWT (JSON Web Token) encoding operations in Rust code that lack proper expiration claims. JWTs without expiration times remain valid indefinitely, creating a security risk where compromised tokens cannot be naturally expired and may be used for unauthorized access long after they should have become invalid.

Detection Strategy

• Code must import the 'jsonwebtoken' library or have it as a dependency prefix

• The detector identifies calls to JWT encoding functions from the jsonwebtoken library

• For each JWT encode call, it analyzes the claims parameter to check if an expiration field ('exp') is present

• A vulnerability is reported when a JWT encode operation is found that does not include an expiration claim in the token payload

• The detection specifically looks for missing 'exp' claims which are the standard way to set token expiration times in JWT specifications

Vulnerable code example

use jsonwebtoken::{encode, EncodingKey, Header};
use serde::Serialize;

#[derive(Serialize)]
struct Claims {
    sub: String,
    role: String,
    // Missing exp field - JWT never expires...

✅ Secure code example

use jsonwebtoken::{encode, EncodingKey, Header};
use serde::Serialize;

#[derive(Serialize)]
struct Claims {
    sub: String,
    role: String,
    exp: usize, // Added expiration field...