Source kernel · Security

JWT signature validation turned off

rust_doctor::source::disabled_jwt_validation

Decode with a Validation that checks the signature and the key it expects; read unverified claims only to select that key, then verify the token before trusting any claim.

Category: Security
Default level: warn
Tier: P0
Producer: Source kernel
Diff scope: item

Not a defect when

The decoded claims are only used to pick the verification key or issuer, and the token is verified with signature checks before any claim is trusted.

Crates it waits for

It runs only where at least one of these crates is resolved, and every one resolved sits in the range it was validated on:

jsonwebtoken *

What it reads

Source text, without resolving types or expanding macros.

Tier

Gravest tier: caps the score of its dimension.

The tier bounds how severe a rule may be; its category bounds the tier.

Diff scope

The function or item around the changed line.

What --scope contextual looks at to decide whether a change caused the finding.

Change it

Turn it off, or make it blocking, without touching the code it flags:

rust-doctor --rule rust_doctor::source::disabled_jwt_validation=off .
rust-doctor --rule rust_doctor::source::disabled_jwt_validation=error .