{"action":"created","issue":{"url":"https://api.github.com/repos/auth0/node-jsonwebtoken/issues/69","labels_url":"https://api.github.com/repos/auth0/node-jsonwebtoken/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/auth0/node-jsonwebtoken/issues/69/comments","events_url":"https://api.github.com/repos/auth0/node-jsonwebtoken/issues/69/events","html_url":"https://github.com/auth0/node-jsonwebtoken/pull/69","id":62237722,"number":69,"title":"Verification with an asymmetric key of a token signed with a symmetric key","user":{"login":"jfromaniello","id":178512,"avatar_url":"https://avatars.githubusercontent.com/u/178512?v=3","gravatar_id":"","url":"https://api.github.com/users/jfromaniello","html_url":"https://github.com/jfromaniello","followers_url":"https://api.github.com/users/jfromaniello/followers","following_url":"https://api.github.com/users/jfromaniello/following{/other_user}","gists_url":"https://api.github.com/users/jfromaniello/gists{/gist_id}","starred_url":"https://api.github.com/users/jfromaniello/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfromaniello/subscriptions","organizations_url":"https://api.github.com/users/jfromaniello/orgs","repos_url":"https://api.github.com/users/jfromaniello/repos","events_url":"https://api.github.com/users/jfromaniello/events{/privacy}","received_events_url":"https://api.github.com/users/jfromaniello/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-16T23:37:05Z","updated_at":"2015-03-16T23:46:51Z","closed_at":"2015-03-16T23:38:21Z","pull_request":{"url":"https://api.github.com/repos/auth0/node-jsonwebtoken/pulls/69","html_url":"https://github.com/auth0/node-jsonwebtoken/pull/69","diff_url":"https://github.com/auth0/node-jsonwebtoken/pull/69.diff","patch_url":"https://github.com/auth0/node-jsonwebtoken/pull/69.patch"},"body":"There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).\r\n\r\nThe issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).\r\n\r\nThis change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is:\r\n```\r\n[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]\r\n``` \r\notherwise is \r\n```\r\n[ 'HS256','HS384','HS512' ]\r\n````"},"comment":{"url":"https://api.github.com/repos/auth0/node-jsonwebtoken/issues/comments/81996870","html_url":"https://github.com/auth0/node-jsonwebtoken/pull/69#issuecomment-81996870","issue_url":"https://api.github.com/repos/auth0/node-jsonwebtoken/issues/69","id":81996870,"user":{"login":"pose","id":419703,"avatar_url":"https://avatars.githubusercontent.com/u/419703?v=3","gravatar_id":"","url":"https://api.github.com/users/pose","html_url":"https://github.com/pose","followers_url":"https://api.github.com/users/pose/followers","following_url":"https://api.github.com/users/pose/following{/other_user}","gists_url":"https://api.github.com/users/pose/gists{/gist_id}","starred_url":"https://api.github.com/users/pose/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pose/subscriptions","organizations_url":"https://api.github.com/users/pose/orgs","repos_url":"https://api.github.com/users/pose/repos","events_url":"https://api.github.com/users/pose/events{/privacy}","received_events_url":"https://api.github.com/users/pose/received_events","type":"User","site_admin":false},"created_at":"2015-03-16T23:46:51Z","updated_at":"2015-03-16T23:46:51Z","body":"@jfromaniello Thanks for fixing this :)"}}