Weak JWT validation (ARCH327)

Key dotnet.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Turning off issuer, audience, or signature checks in JWT validation parameters lets attackers forge or tamper with tokens to bypass authentication.

Incorrect

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer = false,
    ValidateAudience = false,
    ValidateIssuerSigningKey = false,
    SignatureValidator = (token, _) => new JwtSecurityToken(token)
};

Correct

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidIssuer = config["Jwt:Issuer"],
    ValidateAudience = true,
    ValidAudience = config["Jwt:Audience"],
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = signingKey,
    ValidateLifetime = true
};

Fix

Set ValidateIssuer, ValidateAudience, ValidateIssuerSigningKey, and ValidateLifetime to true, and configure a valid issuer/audience and signing key.