JWT No Validation (ARCH5126)

Key go.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Decoding a JWT without verifying its signature (ParseUnverified or accepting alg: none) lets an attacker freely tamper with the claims. The signature must always be validated.

Incorrect

token, _, _ := new(jwt.Parser).ParseUnverified(
    tokenString, jwt.MapClaims{})
claims := token.Claims.(jwt.MapClaims)

Correct

token, err := jwt.Parse(tokenString, func(t *jwt.Token) (any, error) {
    if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
        return nil, errors.New("unexpected alg")
    }
    return signingKey, nil
})

Fix

Verify the signature with Parse and explicitly check the expected signing algorithm.