Description

This detector identifies insecure JWT encoding in Rust applications that may expose sensitive information. When JWT tokens are created without proper payload validation or with sensitive data directly encoded, it can lead to information disclosure vulnerabilities where confidential user data becomes accessible to unauthorized parties.

Detection Strategy

• The application must import both the 'jsonwebtoken' library and the 'actix_web' framework

• The code contains function calls that perform JWT token encoding operations

• The JWT encoding call is identified as unsafe, potentially including sensitive information in the token payload without proper sanitization or validation

Vulnerable code example

use actix_web::{post, web, HttpResponse};
use jsonwebtoken::{encode, EncodingKey, Header};
use serde::Serialize;
use std::collections::HashMap;

#[derive(Serialize)]
struct Claims {
    sub: String,...

✅ Secure code example

use actix_web::{post, web, HttpResponse};
use jsonwebtoken::{encode, EncodingKey, Header};
use serde::Serialize;
use std::collections::HashMap;

#[derive(Serialize)]
struct Claims {
    sub: String,...