Deep dive into JWT Algorithm Confusion

The talk opens with why JSON Web Tokens are so widely used for sessions, API calls and service-to-service trust, then walks through the basics: the three-part layout, URL-safe encoding, and the contrast between shared HMAC secrets and RSA or ECDSA key pairs. It highlights the header's algorithm field, which a verifier reads before checking the signature, as the point where things can go wrong.

The middle section explains algorithm confusion: a token claiming HMAC is checked using an RSA or ECDSA public key as the secret. The speaker shows how an ECDSA public key can be recovered from signatures on two tokens, and how an RSA key can be brute-forced from tokens, then runs live demos that forge a token and log in as an admin. Code walkthroughs of several libraries follow, including a Scala library that trusted the token's algorithm, a C library with the same flaw, and a Ruby library whose key-type check only applied when signing.

Defenses are compared: restricting the library to one configured algorithm, ignoring the token's algorithm, combining both, and detecting key types, which can be fragile when based on regular expressions, as a past CVE showed. The closing advice covers enforcing one algorithm, rejecting the none algorithm, setting expiry, and running scheduled tests that send unsigned tokens to your own services.