Metadata

ID: kotlin-security/secure-jwt-algorithm

Language: Kotlin

Severity: Error

Category: Security

CWE: 327

Description

This rule helps maintain the integrity and security of JSON Web Tokens (JWTs) in your Kotlin applications. JWTs are often used for authentication and information exchange, which makes them a prime target for malicious attacks. Using the none algorithm in JWT creation means that the tokens are not signed or validated, which can lead to token forgery and unauthorized access to sensitive data.

This rule is important because an attacker can modify the token payload when the algorithm is none. In this case, because there is no signature to verify that the content was not tampered with, the attacker can impersonate any user. This can lead to serious security breaches.

To adhere to this rule, always use a secure algorithm when creating JWTs. For instance, use HMAC combined with SHA-256 (HMAC256). This ensures that the tokens are signed and validated, preventing token forgery. Additionally, handle exceptions properly to ensure your application can respond effectively to any JWT creation errors.

Non-Compliant Code Examples

// Non-compliant: Using 'none' algorithm which allows token forgery
fun createUnsafeJwtToken(issuer: String): String {
    try {
        // WARNING: This allows attackers to forge tokens
        val algorithm = Algorithm.none()
        return JWT.create()
            .withIssuer(issuer)
            .sign(algorithm)
    } catch (e: JWTCreationException) {
        throw SecurityException("Failed to create JWT token", e)
    }
}

Compliant Code Examples

// Compliant: Using secure HMAC256 algorithm
fun createSecureJwtToken(issuer: String, secretKey: String): String {
    try {
        // Secure algorithm with proper key
        val algorithm = Algorithm.HMAC256(secretKey)
        return JWT.create()
            .withIssuer(issuer)
            .withIssuedAt(Date())
            .sign(algorithm)
    } catch (e: JWTCreationException) {
        throw SecurityException("Failed to create JWT token", e)
    }
}

Seamless integrations. Try Datadog Code Security

Datadog Code Security