<story><title>Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful</title><url>https://insomniasec.com/blog/auth0-jwt-validation-bypass</url></story><parent_chain><item><author>CiPHPerCoder</author><text>Tired: {&amp;quot;alg&amp;quot;:&amp;quot;none&amp;quot;}&lt;p&gt;Wired: {&amp;quot;alg&amp;quot;:&amp;quot;nonE&amp;quot;}&lt;p&gt;The JOSE standards (including JWT) are a gift that keeps on giving to attackers.&lt;p&gt;I designed an alternative format in 2018 called PASETO, which doesn&amp;#x27;t contain the JOSE foot-guns. (I&amp;#x27;m pushing for an IETF RFC this year.)&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;paseto.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;paseto.io&lt;/a&gt;&lt;p&gt;EDIT: Also, this affected their Authentication API rather than their JWT library.&lt;p&gt;If you use their JWT library, well, it certainly &lt;i&gt;allows&lt;/i&gt; this kind of horrendous misuse... but it is not, per se, vulnerable.</text></item></parent_chain><comment><author>speedgoose</author><text>Before starting a new project some time ago, I read about the critics to JOSE (JWE) and the alternative PASETO. I decided to use JOSE carefully instead of PASETO because it had an IETF RFC. I think it will be great for PASETO to get a RFC as well. The second point that made me chose JOSE was that PASETO was a bit too mean towards JOSE, and I didn&amp;#x27;t want drama in my technology choices.&lt;p&gt;But good work! With a RFC PASETO will be my choice for my next projects.</text></comment>
<story><title>Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful</title><url>https://insomniasec.com/blog/auth0-jwt-validation-bypass</url></story><parent_chain><item><author>CiPHPerCoder</author><text>Tired: {&amp;quot;alg&amp;quot;:&amp;quot;none&amp;quot;}&lt;p&gt;Wired: {&amp;quot;alg&amp;quot;:&amp;quot;nonE&amp;quot;}&lt;p&gt;The JOSE standards (including JWT) are a gift that keeps on giving to attackers.&lt;p&gt;I designed an alternative format in 2018 called PASETO, which doesn&amp;#x27;t contain the JOSE foot-guns. (I&amp;#x27;m pushing for an IETF RFC this year.)&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;paseto.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;paseto.io&lt;/a&gt;&lt;p&gt;EDIT: Also, this affected their Authentication API rather than their JWT library.&lt;p&gt;If you use their JWT library, well, it certainly &lt;i&gt;allows&lt;/i&gt; this kind of horrendous misuse... but it is not, per se, vulnerable.</text></item></parent_chain><comment><author>different_sort</author><text>Why a new standard than to push for reform to the current standard?&lt;p&gt;Are they just closely protected by greybeards who won&amp;#x27;t listen to reason?&lt;p&gt;Question comes from a true place of ignorance&amp;#x2F;curiosity, I definitely understand the need to have unambiguous, easy to implement security tokens without the foot-guns.</text></comment>