JWT No Validation (ARCH9126)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key swift.security.jwt-no-validation · Severity error · Category security · CWE CWE-347
Flags JWTs read without verification (signers.unverified, JWTDecode decode(jwt:) used for auth, verify skipped).
Incorrect
Section titled “Incorrect”let payload = try req.jwt.unverified(token, as: Payload.self)Correct
Section titled “Correct”let payload = try req.jwt.verify(token, as: Payload.self)Verify the signature and expected claims before trusting any of them.