Closed moonman239 closed 1 year ago
Specification of JWT
That is what you get
import jwt key = "secret" encoded = jwt.encode({"some": "payload"}, key, algorithm="HS256") print(encoded)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg
jwt.decode(encoded, key, algorithms="HS256")
{'some': 'payload'}
mal_encoded = "345"+encoded jwt.decode(mal_encoded, key, algorithms="HS256")
Traceback (most recent call last): File "C:\Users\kaira\AppData\Local\Programs\Python\Python310\lib\site-packages\jwt\api_jws.py", line 261, in _load header = json.loads(header_data) File "C:\Users\kaira\AppData\Local\Programs\Python\Python310\lib\json__init__.py", line 341, in loads s = s.decode(detect_encoding(s), 'surrogatepass') UnicodeDecodeError: 'utf-8' codec can't decode byte 0x88 in position 9: invalid start byte
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "
Bad key gives
Traceback (most recent call last):
File "
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days
Suppose a hacker tries to pass a token to my server, that did not originate from my server. How do I detect when this happens?
I am guessing that If the token was not something generated and signed with my key, then one of two things will happen: 1) pyjwt will throw a JSONDecode error. jwt.decode won't even be able to decode the token, as the decryption algorithm will produce garbledygook. 2) jwt.decode returns an object, but it won't have any of the expected keys (because, again, garbledygook) so any attempt to access an expected key will result in a KeyError.