Exploiting JSON Web Tokens
JSON Web Tokens (JWT) are used primarily for authentication. When a user logs into a website successfully, the user is assigned a JWT in a cookie. These tokens offer users security mechanisms such as encryption and a signature. Additionally, JWT's follow the pattern of Base64(Header).Base64(Data).Base64(Signature) . When headers are unsigned, attackers can manipulate it by changing the algorithm that is used in the signature of the JWT. In order to sign a header, the header itself needs to verify the signature and in turn, the signature needs to verify the header. According to Auth0's Tim McLean's 2015 post ( https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries ) : "JWTs generally have three parts: a header, a payload, and a signature. The header identifies which algorithm is used to generate the signature, and looks something like this: header = '{"alg":"HS256","typ":"JWT"}' ...