kairat-beep
commented
1 year ago Specification of JWT
- Verify that the resulting octet sequence is a UTF-8-encoded representation of a completely valid JSON object conforming to RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.
That is what you get
import jwt key = "secret" encoded = jwt.encode({"some": "payload"}, key, algorithm="HS256") print(encoded)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg
jwt.decode(encoded, key, algorithms="HS256")
{'some': 'payload'}
mal_encoded = "345"+encoded jwt.decode(mal_encoded, key, algorithms="HS256")
Traceback (most recent call last): File "C:\Users\kaira\AppData\Local\Programs\Python\Python310\lib\site-packages\jwt\api_jws.py", line 261, in _load header = json.loads(header_data) File "C:\Users\kaira\AppData\Local\Programs\Python\Python310\lib\json__init__.py", line 341, in loads s = s.decode(detect_encoding(s), 'surrogatepass') UnicodeDecodeError: 'utf-8' codec can't decode byte 0x88 in position 9: invalid start byte
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "
github-actions[bot]
Suppose a hacker tries to pass a token to my server, that did not originate from my server. How do I detect when this happens?
I am guessing that If the token was not something generated and signed with my key, then one of two things will happen: 1) pyjwt will throw a JSONDecode error. jwt.decode won't even be able to decode the token, as the decryption algorithm will produce garbledygook. 2) jwt.decode returns an object, but it won't have any of the expected keys (because, again, garbledygook) so any attempt to access an expected key will result in a KeyError.