Hacker News Reader

https://github.com/auth0/node-jsonwebtoken/blob/5f10bf9957a2...

The end result depends entirely on the behavior of JavaScript's Array.indexOf() implementation.

Good catch. JWT is unicode out-of-the-box, which is really important to support non english user names and such.

If Auth0 is doing any sort of normalization they will definitely be vulnerable to all the normalization bugs from unicode. Would be a great follow up vulnerability.

The answer to that is we should not be using _any_ case-insensitive strings in protocols.

They are fine for human-visible names, but field names and internal enum values should use byte-by-byte comparison. It just makes entire class of vulnerabilities go away.

They are case-sensitive.

> The "alg" value is a case-sensitive ASCII string containing a StringOrURI value. This Header Parameter MUST be present and MUST be understood and processed by implementations.

But the protocol says that they are case-insensitive! is not a good response to the assertion that machine-to-machine protocols should not be case-insensitive, which is what theamk said.