From 6a57701cf6ec127a5ace39bd74a16256fb1a3e02 Mon Sep 17 00:00:00 2001 From: Chris Guest Date: Mon, 28 Jul 2025 13:24:11 +0100 Subject: [PATCH 1/2] feat: Add .env.template and .gitignore for JWT token management - Created a new .env.template file to define the JWT_TOKEN variable. - Added .gitignore to exclude the .env file from version control. - Updated README.md to include sections on JWT algorithm switching vulnerability and resources for further reading. Autogenerated by copilot --- 52_jwt_tokens/.env.template | 1 + 52_jwt_tokens/.gitignore | 1 + 52_jwt_tokens/README.md | 13 +++++++++++++ 3 files changed, 15 insertions(+) create mode 100644 52_jwt_tokens/.env.template create mode 100644 52_jwt_tokens/.gitignore create mode 100644 52_jwt_tokens/README.md diff --git a/52_jwt_tokens/.env.template b/52_jwt_tokens/.env.template new file mode 100644 index 0000000..e8233f2 --- /dev/null +++ b/52_jwt_tokens/.env.template @@ -0,0 +1 @@ +JWT_TOKEN= \ No newline at end of file diff --git a/52_jwt_tokens/.gitignore b/52_jwt_tokens/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/52_jwt_tokens/.gitignore @@ -0,0 +1 @@ +.env diff --git a/52_jwt_tokens/README.md b/52_jwt_tokens/README.md new file mode 100644 index 0000000..2c92665 --- /dev/null +++ b/52_jwt_tokens/README.md @@ -0,0 +1,13 @@ +# JWT + + +## JWT Algorithm Switching Vulnerability + +```sh +. ./.env +echo ${JWT_TOKEN} | base64 -di +``` + +## Resources + +* https://www.vaadata.com/blog/jwt-json-web-token-vulnerabilities-common-attacks-and-security-best-practices/ \ No newline at end of file From a526f3018c57a7d9f807ca390638bd71ca7147c7 Mon Sep 17 00:00:00 2001 From: Chris Guest Date: Mon, 28 Jul 2025 13:24:18 +0100 Subject: [PATCH 2/2] feat: Update README to include TODO section for vulnerable auth packages - Added a TODO section to the README.md file to encourage experimentation with vulnerable authentication packages. Autogenerated by copilot --- 52_jwt_tokens/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/52_jwt_tokens/README.md b/52_jwt_tokens/README.md index 2c92665..9510744 100644 --- a/52_jwt_tokens/README.md +++ b/52_jwt_tokens/README.md @@ -1,5 +1,8 @@ # JWT +TODO: + +* Play around with some vulnerable auth packages. ## JWT Algorithm Switching Vulnerability