vimalloc / vimalloc/flask-jwt-extended
JWT tokens pass verification even when last characters are altered
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.6k
- Forks
- 253
- PR merge metrics
- No merged PRs in 30d
Description
When using flask_jwt_extended to create and verify access tokens (HS256), I noticed that modifying the last 1–2 characters of the token still results in a successful verification — the request is not rejected by @jwt_required().
I call the API using curl command, and as an example the real token is:
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTc2MDYyMjk2OSwianRpIjoiN2Y0NzgxZDQtOTE2ZS00OWJiLWE0OWYtMmNhZGU3MWYzZmNhIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6Im5hdmlkIiwibmJmIjoxNzYwNjIyOTY5LCJjc3JmIjoiMDBhZGVjNWUtYTQ2NS00NmIwLTkxNTktODU2ZDRlMmIwNTU1IiwiZXhwIjoxNzYwNjIzMDI5fQ.qRmogYLGxISt1klwYxepJCh4wYBYihFlFYN5ADaSt34"
but also it is passed by these tokens:
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTc2MDYyMjk2OSwianRpIjoiN2Y0NzgxZDQtOTE2ZS00OWJiLWE0OWYtMmNhZGU3MWYzZmNhIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6Im5hdmlkIiwibmJmIjoxNzYwNjIyOTY5LCJjc3JmIjoiMDBhZGVjNWUtYTQ2NS00NmIwLTkxNTktODU2ZDRlMmIwNTU1IiwiZXhwIjoxNzYwNjIzMDI5fQ.qRmogYLGxISt1klwYxepJCh4wYBYihFlFYN5ADaSt32",
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTc2MDYyMjk2OSwianRpIjoiN2Y0NzgxZDQtOTE2ZS00OWJiLWE0OWYtMmNhZGU3MWYzZmNhIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6Im5hdmlkIiwibmJmIjoxNzYwNjIyOTY5LCJjc3JmIjoiMDBhZGVjNWUtYTQ2NS00NmIwLTkxNTktODU2ZDRlMmIwNTU1IiwiZXhwIjoxNzYwNjIzMDI5fQ.qRmogYLGxISt1klwYxepJCh4wYBYihFlFYN5ADaSt24",
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTc2MDYyMjk2OSwianRpIjoiN2Y0NzgxZDQtOTE2ZS00OWJiLWE0OWYtMmNhZGU3MWYzZmNhIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6Im5hdmlkIiwibmJmIjoxNzYwNjIyOTY5LCJjc3JmIjoiMDBhZGVjNWUtYTQ2NS00NmIwLTkxNTktODU2ZDRlMmIwNTU1IiwiZXhwIjoxNzYwNjIzMDI5fQ.qRmogYLGxISt1klwYxepJCh4wYBYihFlFYN5ADaSt33"
and etc.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior with the curl request and @jwt_required() using the provided valid token and altered final characters. Trace JWT verification to determine why those altered tokens are accepted; done means modified tokens are rejected while the original token still verifies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- flask, python
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100