This rule helps maintain the integrity and security of JSON Web Tokens (JWTs) in your Kotlin applications. JWTs are often used for authentication and information exchange, which makes them a prime target for malicious attacks. Using the none algorithm in JWT creation means that the tokens are not signed or validated, which can lead to token forgery and unauthorized access to sensitive data.
This rule is important because an attacker can modify the token payload when the algorithm is none. In this case, because there is no signature to verify that the content was not tampered with, the attacker can impersonate any user. This can lead to serious security breaches.
To adhere to this rule, always use a secure algorithm when creating JWTs. For instance, use HMAC combined with SHA-256 (HMAC256). This ensures that the tokens are signed and validated, preventing token forgery. Additionally, handle exceptions properly to ensure your application can respond effectively to any JWT creation errors.
Non-Compliant Code Examples
// Non-compliant: Using 'none' algorithm which allows token forgery
funcreateUnsafeJwtToken(issuer:String):String{try{// WARNING: This allows attackers to forge tokens
valalgorithm=Algorithm.none()returnJWT.create().withIssuer(issuer).sign(algorithm)}catch(e:JWTCreationException){throwSecurityException("Failed to create JWT token",e)}}
Compliant Code Examples
// Compliant: Using secure HMAC256 algorithm
funcreateSecureJwtToken(issuer:String,secretKey:String):String{try{// Secure algorithm with proper key
valalgorithm=Algorithm.HMAC256(secretKey)returnJWT.create().withIssuer(issuer).withIssuedAt(Date()).sign(algorithm)}catch(e:JWTCreationException){throwSecurityException("Failed to create JWT token",e)}}
Seamless integrations. Try Datadog Code Security
Datadog Code Security
Try this rule and analyze your code with Datadog Code Security
How to use this rule
1
2
rulesets:- kotlin-security # Rules to enforce Kotlin security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Security scans to your CI pipelines