search

pallets-eco / flask-jwt

JWT (JSON Web Tokens) for Flask applications
MIT License
564 stars 177 forks source link

Vulnerabilities found in PyJWT back in 2015 #119

Open GeekOnGadgets opened 7 years ago

GeekOnGadgets commented 7 years ago

Hi,

Thanks for awesome library. Just wanted to confirm something related to PyJWT library you are using in your project. Back in 2015 (https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/) Vulnerability issue was found with PyJWT not sure if that has been fixed now or still have to do a work around? Can't find much information out there.

Sorry for creating this as a issue. Hope you can provide with some info.

Thanks

yunderboy commented 7 years ago

@GeekOnGadgets do you know whether this project is still going?

Thanks

GeekOnGadgets commented 7 years ago

@yunderboy I don't think so. use https://github.com/vimalloc/flask-jwt-extended

vimalloc commented 7 years ago

Not sure about this extension, but for what it's worth Flask JWT Extended is protected against this vulnerability.

yunderboy commented 7 years ago

@vimalloc, cool! Any idea on how long you might be maintaining the extension, and would you happen to need some help?

vimalloc commented 7 years ago

We use the extension at my job, so it will be maintained for quiet a while yet. And I would never turn down any help :+1: