Comment by rvz | Hacker News Reader

Comment by rvz | Hacker News Reader

So which one is a JWT hackers?

  A) v1.local.CuizxAzVIz5bCqAjsZpXXV5mk_WWGHbVxmdF81DORwyYcMLvzoUHUmS_VKvJ1hn5zXyoMkygkEYLM2LM00uBI3G9gXC5VrZCUM-BLZo1q9IDIncAZTxYkE1NUTMz

  B) eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkhpIEhhY2tlciBOZXdzIiwiaWF0IjoxNTE2MjM5MDIyfQ.IlIR9_imqGCgEVG_QUb4LhDwSeNhYc50t3Ij5x126scVNJFQqCveblmHx__tqjaI

  C) ATkJzynwvPlX6PxBU5BO5xa96S6vymIbmIZnk9og7KxhLHqYLoneLK6WTkyyuGFk7uWZZUnQFVTaThmHzFvaf

  D) gAAAAABezWTi-jcq7zlfBaR0vGUy-B9WJ_3lL6S48JO7t9LiW4283zOqBAJvJZEAvusn7OKpgyyoPp2p7okVE4TQfYuihDou67vOHH6G0zqdQz0_1NLvSTM=

If you know which one it is straightaway, then it is the worst choice out of all of them, (because it is not encrypted by default). I would chose the least obvious one here.

You can recognize JWTs without decoding by checking the string format:

JSON Web Tokens follow this format → ALGO+TokenType.Payload.Signature

So obviously the only valid JWT in your question is “B”.

    B) eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9
       .
       eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6
       IkhpIEhhY2tlciBOZXdzIiwiaWF0IjoxNTE2
       MjM5MDIyfQ
       .
       IlIR9_imqGCgEVG_QUb4LhDwSeNhYc50t3Ij
       5x126scVNJFQqCveblmHx__tqjaI

But this does not matter because you are not supposed to decode random strings expecting them to be JSON Web Tokens. That would be as stupid as assuming that any 32-bytes string is MD5 or any 40-bytes string is SHA1, etc. You either know what your input’s format is or you do not in which case you should not even attempt to decode it because it clearly is not a valid input.

And another party trick: Base64-encoded JSON objects always start with "ey".

I'm not sure what you're trying to say here? Only one of these is a valid JWT.

JWTs don't concern themselves with privacy, only authenticity. The fact you can read the JWT is irrelevant.

B?

Reply on news.ycombinator.com