JWT alg:none Bypass — Why Your Token Validation Is Broken

package io.thecodeforge.api;

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.security.interfaces.RSAPublicKey;

/**
 * Production JWT validation — explicit algorithms, no defaults, no alg:none.
 * The single most common security failure in API production incidents
 * is accepting tokens with alg:none due to library defaults.
 */
public class JwtValidation {

    // ─── SYMMETRIC KEY (HS256) — single secret shared between issuer and validator
    // Only use when issuer and validator are the same service.
    // Secret must be at least 32 bytes (256 bits) for HS256.
    public static DecodedJWT validateSymmetric(String token, String secret) {
        Algorithm algorithm = Algorithm.HMAC256(secret);
        JWTVerifier verifier = JWT.require(algorithm)
            .acceptLeeway(60)                    // 60 seconds clock skew tolerance
            .withIssuer("auth.thecodeforge.io")  // Restrict to trusted issuer
            .build();
        // Throws JWTVerificationException on failure — signature, expiry, issuer mismatch
        return verifier.verify(token);
    }

    // ─── ASYMMETRIC KEY (RS256) — public key for validation, private key for signing
    // Preferred for microservices: validation service only needs public key.
    // Compromised validation service cannot forge new tokens (needs private key).
    public static DecodedJWT validateAsymmetric(String token, RSAPublicKey publicKey) {
        Algorithm algorithm = Algorithm.RSA256(publicKey, null);
        JWTVerifier verifier = JWT.require(algorithm)
            .acceptLeeway(60)
            .withIssuer("auth.thecodeforge.io")
            .build();
        return verifier.verify(token);
    }

    // ─── EXPLICITLY REJECT ALG:NONE — the most dangerous JWT misconfiguration
    // Attackers send {"alg":"none","typ":"JWT"} with empty signature.
    // Libraries that don't explicitly reject it skip verification entirely.
    public static void rejectAlgNone(String tokenHeader) {
        if (tokenHeader.contains("\"alg\":\"none\"")) {
            throw new SecurityException("alg:none tokens are never accepted — possible attack");
        }
    }

    // ─── Extract claims after validation — never before!
    // Claims from an unverified token are attacker-controlled and MUST NOT be trusted.
    public static void processClaims(DecodedJWT verifiedToken) {
        String userId = verifiedToken.getSubject();
        String role = verifiedToken.getClaim("role").asString();
        // Only after verification — these claims are now trusted
        System.out.printf("Authenticated user: %s with role: %s%n", userId, role);
    }
}

package io.thecodeforge.api;

import redis.clients.jedis.Jedis;
import redis.clients.jedis.JedisPool;
import redis.clients.jedis.params.SetParams;

/**
 * Production distributed rate limiter using Redis with atomic INCR + EXPIRE.
 * This works correctly across multiple API gateway instances.
 *
 * Key pattern: rate_limit:{userId}:{minute_window}
 * Window granularity: 60 seconds aligned to wall clock minute.
 * Trade-off: fixed window allows double-burst at window boundaries.
 * For sliding window, use sorted sets (ZADD + ZREMRANGEBYSCORE).
 */
public class RedisRateLimiter {

    private final JedisPool jedisPool;
    private final int limitPerMinute;

    public RedisRateLimiter(String redisHost, int port, int limitPerMinute) {
        this.jedisPool = new JedisPool(redisHost, port);
        this.limitPerMinute = limitPerMinute;
    }

    /**
     * Check if request is allowed for this user.
     * Returns true if under limit, false if rate limited.
     */
    public boolean isAllowed(String userId) {
        // Fixed window aligned to current minute
        long currentMinute = System.currentTimeMillis() / 60000;
        String key = String.format("rate_limit:%s:%d", userId, currentMinute);

        try (Jedis jedis = jedisPool.getResource()) {
            // Atomic increment — returns the new count
            long currentCount = jedis.incr(key);

            // Set expiry on first increment only (60 seconds + 1 second buffer)
            if (currentCount == 1) {
                jedis.expire(key, 61);
            }

            return currentCount <= limitPerMinute;
        }
    }

    /**
     * Sliding window rate limiter using Redis sorted sets.
     * More accurate but higher memory and CPU overhead.
     * Use for strict rate limits where fixed window bursts are unacceptable.
     */
    public boolean isAllowedSlidingWindow(String userId, int limitPerMinute) {
        String key = String.format("rate_limit_sliding:%s", userId);
        long nowMs = System.currentTimeMillis();
        long windowStartMs = nowMs - 60000;  // 60 seconds ago

        try (Jedis jedis = jedisPool.getResource()) {
            // Remove requests older than 60 seconds
            jedis.zremrangeByScore(key, 0, windowStartMs);

            // Count requests in current window
            long requestCount = jedis.zcard(key);

            if (requestCount >= limitPerMinute) {
                return false;  // Rate limited
            }

            // Add current request with timestamp as score
            jedis.zadd(key, nowMs, String.format("%d:%s", nowMs, userId + System.nanoTime()));
            jedis.expire(key, 61);  // Auto-cleanup

            return true;
        }
    }
}

package io.thecodeforge.api;

import java.util.regex.Pattern;
import java.util.UUID;

/**
 * Production input validation — validate early, validate strictly.
 * All input from clients is attacker-controlled until proven otherwise.
 *
 * Key principles:
 *   1. Validate type, length, format, and range
 *   2. Use allowlists (known-good patterns), not denylists (known-bad)
 *   3. Validate before authentication to reject junk early
 *   4. Parameterize queries — validation is NOT a replacement for prepared statements
 */
public class InputValidation {

    // ─── ALLOWLIST PATTERNS — explicit, strict, minimal ──────────────────────
    private static final Pattern UUID_PATTERN =
        Pattern.compile("^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", Pattern.CASE_INSENSITIVE);

    private static final Pattern USERNAME_PATTERN =
        Pattern.compile("^[a-zA-Z0-9_]{3,20}$");  // Alphanumeric + underscore, 3-20 chars

    private static final Pattern EMAIL_PATTERN =
        Pattern.compile("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$");

    private static final Pattern ORDER_ID_PATTERN =
        Pattern.compile("^ORD-[0-9]{10,15}$");    // ORD-1234567890

    // ─── Input validation methods — early returns, clear error messages ──────
    public static boolean isValidUUID(String value) {
        if (value == null) return false;
        return UUID_PATTERN.matcher(value).matches();
    }

    public static boolean isValidUsername(String value) {
        if (value == null) return false;
        return USERNAME_PATTERN.matcher(value).matches();
    }

    // ─── LENGTH VALIDATION — always enforce maximums, even for legitimate fields
    // Email spec allows 254 characters total. Most legitimate emails are under 50.
    // Reject excessively long inputs early to prevent resource exhaustion.
    public static String validateAndSanitizeEmail(String input) {
        if (input == null || input.length() > 254) {
            throw new IllegalArgumentException("Invalid email format or length");
        }
        String trimmed = input.trim();
        if (!EMAIL_PATTERN.matcher(trimmed).matches()) {
            throw new IllegalArgumentException("Invalid email format");
        }
        return trimmed;
    }

    // ─── ENUM VALIDATION — reject anything not in the explicit set
    public enum OrderStatus { PENDING, PROCESSING, SHIPPED, DELIVERED, CANCELLED }

    public static OrderStatus validateOrderStatus(String input) {
        if (input == null) throw new IllegalArgumentException("Status is required");
        try {
            return OrderStatus.valueOf(input.toUpperCase());
        } catch (IllegalArgumentException e) {
            throw new IllegalArgumentException("Invalid status: " + input +
                ". Allowed values: PENDING, PROCESSING, SHIPPED, DELIVERED, CANCELLED");
        }
    }

    // ─── PARAMETERIZED QUERY — the only real defense against SQL injection
    // Input validation catches obviously malicious input, but parameterization
    // is what makes injection structurally impossible.
    public static void parameterizedQueryExample() {
        // NEVER do this:
        // String query = "SELECT * FROM users WHERE id = '" + userId + "'";

        // ALWAYS do this:
        // PreparedStatement stmt = connection.prepareStatement(
        //     "SELECT * FROM users WHERE id = ?"
        // );
        // stmt.setString(1, userId);
    }
}