Hacker GitHub

← All repos

auth0/node-jsonwebtoken

View on GitHub ↗ ★ 18,184 JavaScript

JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

8 mentions on Hacker News by 8 people: 0 stories, 8 comments · first 2015-02-26 · latest 2020-09-02

Mentions per year 8 mentions · busiest year 2020 (4)
20082026
AllStoriesComments NewestTopOldest
  1. …the public API might be a hard sell). I really have no idea why this is part of the public API. https://github.com/auth0/node-jsonwebtoken/pull/741
    comment by equidistant · 2020-09-02 · in # of days since the last alg=none JWT vulnerability
  2. …like the one you think you want to use. jwt.decode() doesn't verify the token when decoding: https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--o... If you dig through Node repos on Github searching for "jwt.decode()" or…
    comment by gavinray · 2020-09-01 · in # of days since the last alg=none JWT vulnerability
  3. If you don't set it it's set to a reasonable list of algorithms [0], which doesn't include "none" https://github.com/auth0/node-jsonwebtoken/blob/master/verif...
    comment by wongarsu · 2020-04-16 · in Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful
  4. https://github.com/auth0/node-jsonwebtoken/blob/5f10bf9957a2... The end result depends entirely on the behavior of JavaScript's Array.indexOf() implementation.
    comment by CiPHPerCoder · 2020-04-16 · in Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful
  5. …and verifying the token, but after that it's fairly plain sailing. [1]: https://jwt.io [2]: https://github.com/auth0/node-jsonwebtoken [3]: https://auth0.com [4]: https://jwt.io/introduction/
    comment by shocked-pikachu · 2018-12-27 · in Ask HN: What do you use for authentication and authorization?
  6. …most used library automatically uses asymmetric keys when one is given, ignoring the header ( https://github.com/auth0/node-jsonwebtoken/blob/master/verif... ) As long as the problem is known to the developers and the key is specified, I…
    comment by jacopofar2 · 2017-03-14 · in JSON Web Tokens should be avoided
  7. …really true? I mean, if you can decode the token you must have access to the secret anyway? From https://github.com/auth0/node-jsonwebtoken var token = jwt.sign({ foo: 'bar' }, 'shhhhh'); var decoded = jwt.verify(token, 'shhhhh');…
    comment by Kiro · 2016-06-15 · in Use JWT the Right Way
  8. …because the combination of 'RequireSignedTokens' = false, and a non-null key, is invalid. [1] - https://github.com/auth0/node-jsonwebtoken/blob/master/index... [2] - https://github.com/AzureAD/azure-activedirectory-identitymod...
    comment by zaroth · 2015-02-26 · in What I don't like about JSON Web Tokens