Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Token validation related security updates in previous versions

See original GitHub issue

Hi,

just discovered: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries and wanted to ask in which version this has been addressed, I’m using .NET 4.6.1 with System.IdentityModel.Tokens.Jwt and can’t upgrade it to 5.x because is it not compatible, thus, I’m stuck with 4.0.3.308261200.

And question is: am I safe? 😃

Thank you!

Issue Analytics

State:
Created 7 years ago
Comments:6 (4 by maintainers)

Top GitHub Comments

1reaction

snekbaevcommented, Dec 1, 2016

@brentschmaltz well, wherever the issue is, one thing for sure is that it will make a lot of people happy not to have that dependency hanging in the nuget’s updates with a note in a readme file saying “DO NOT UPDATE!” 😃))

0reactions

brentschmaltzcommented, Dec 4, 2016

Issue is resolved pertaining to security risk. Back-compat is a separate issue.

Top Results From Across the Web

Access tokens in the Microsoft identity platform

Web apps validating ID tokens, and web APIs validating access tokens need to validate the issuer of the token ( iss claim) against:...

Validate Access Tokens

Describes how to validate an access token. ... An access token is meant for an API and should be validated only by the...

JWT Access Tokens - Identity Provider Plugins - Confluence

Any custom security configuration dating to previous versions will ... jwtSignatureValidationConfiguration (related new property idp.oidc.validation.config).

Use secure token, bootstrap token, and volume ownership ...

Learn how FileVault integrates with secure token and bootstrap token ... In previous versions of macOS on CoreStorage volumes, the keys used ...

Regenerate API keys and tokens

Authentication best practices · Regenerate API keys and tokens · Having a central file for your secrets · Environment variables · Source code...