Hacker News Reader

Comment by rvz | Hacker News Reader

> I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account.

Great writeup there. Looks like a Apple JWT bug and the verification went through despite it being 'signed' and 'tamperproof'. Clearly its footguns allowed this to happen, thus JWTs is the gift that keeps on giving to researchers.

What did I just outline days before? [0]. Just don't use JWTs, there are already secure alternatives available.

[0] https://news.ycombinator.com/item?id=23315026

View on HN

No one should be using JWT but it's unfair to blame JWT here. Apple wasn't verifying the supplied email address belonged to the signed in user - that's completely outside of the token format they chose.

> No one should be using JWT

I've heard criticisms of JWT -- mostly around the lack of ability to revoke a JWT.

One could then introduce a refresh token with a longer ttl, which can be revoked on the server. But of course then you lose some of the statelessness that JWT benefits from.

But still, it seems like a reasonable approach to authentication to me. I can authenticate with several services if need be, and I can check locally if my token is 'likely' valid.

Care to expand why you think one shouldn't use JWT tokens?

> No one should be using JWT

What??

In the apps I write for my org integrating with the org SSO provider, I treat the JWT tokens mostly like a non-JWT token. Verify the token with the IDP, map the token to a specific user and never relying on the JWT payload user info for the resource auth. It takes additional 0.25s during the login process but has never let me down. As the SSO provider was issuing non-JWT tokens few years back, this was the way we went about making sure the user is who they are saying they are and just stuck with the same approach when they moved to JWT tokens.

Your earlier comment, and your comment today, are both baseless.

They demonstrate no issues with JWTs. There are issues with JWTs, but you have not hit on any of them.

Reply on news.ycombinator.com