Missing Authentication with Jwt Tokens

Missing authentication in JWT-based systems occurs when tokens are improperly validated, exposed, or transmitted without proper safeguards. The most common manifestation is when JWTs are sent over HTTP instead of HTTPS, allowing attackers to intercept tokens through network sniffing or man-in-the-middle attacks.

Another critical failure point is improper token validation. Many developers mistakenly implement weak validation logic that only checks token presence rather than cryptographic integrity. For example:

const token = req.headers.authorization?.split(' ')[1];
if (token) {
  // WRONG: Only checking if token exists, not if it's valid
  next();
} else {
  res.status(401).send('Unauthorized');
}

This code accepts any non-empty token, including expired, malformed, or attacker-supplied tokens. The proper approach requires verifying the signature using the correct secret or public key, checking expiration claims, and validating the issuer and audience.

Token leakage through URL parameters represents another severe vulnerability. Developers sometimes embed JWTs in URLs for convenience:

// INSECURE: JWT in URL parameters
app.get('/api/data', (req, res) => {
  const token = req.query.token;
  // Token now appears in browser history, server logs, and referer headers
});

URL-based token transmission exposes credentials through multiple channels: browser history, proxy logs, and referer headers when users click links. This violates the fundamental principle that authentication credentials should never appear in URLs.

Missing authentication also manifests through improper token storage. Storing JWTs in localStorage or sessionStorage exposes them to cross-site scripting (XSS) attacks:

// INSECURE: Storing JWT in localStorage
localStorage.setItem('jwtToken', token);
// Vulnerable to XSS: malicious script can read localStorage
// document.write("")

The secure alternative uses HTTP-only cookies with proper SameSite attributes, preventing JavaScript access while maintaining authentication functionality.

Detecting missing authentication in JWT systems requires examining both code patterns and runtime behavior. Static analysis tools can identify common anti-patterns, but runtime scanning provides definitive evidence of vulnerabilities.

middleBrick's JWT-specific scanning examines endpoints for authentication bypass attempts. The scanner tests unauthenticated access to protected routes, checking if JWT validation is properly enforced. It attempts requests with malformed tokens, expired tokens, and tokens with invalid signatures to verify that the system rejects them appropriately.

Key detection patterns include:

• Endpoints accepting requests without Authorization headers
• Endpoints accepting tokens with invalid signatures
• Endpoints accepting expired tokens
• Endpoints accepting tokens with mismatched issuers or audiences
• Endpoints exposing sensitive data without any authentication

middleBrick's LLM security module also detects AI-specific authentication issues in systems using JWTs for API access to language models. It identifies endpoints where JWTs are improperly validated or transmitted, potentially exposing AI model access to unauthorized users.

Runtime detection involves sending crafted requests to identify authentication weaknesses:

// Test for missing authentication
const axios = require('axios');
const testEndpoint = async (url) => {
  try {
    // Test without token
    const res1 = await axios.get(url);
    if (res1.status === 200) {
      console.log('Missing auth: endpoint accessible without token');
    }
    
    // Test with malformed token
    const res2 = await axios.get(url, {
      headers: { Authorization: 'Bearer invalid.token.here' }
    });
    if (res2.status === 200) {
      console.log('Weak validation: accepts invalid tokens');
    }
  } catch (err) {
    // Expected behavior for properly secured endpoints
  }
};

middleBrick automates these tests across 12 security categories, providing a comprehensive risk assessment without requiring access to source code or credentials.

Proper JWT authentication requires implementing defense-in-depth strategies. The foundation is robust token validation using well-tested libraries rather than custom implementations.

For Node.js applications using Express, the correct pattern involves middleware that validates all aspects of the JWT:

const jwt = require('jsonwebtoken');
const secretKey = process.env.JWT_SECRET;

const authenticateJWT = (req, res, next) => {
  const authHeader = req.headers.authorization;
  
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ message: 'Missing Authorization header' });
  }
  
  const token = authHeader.substring(7);
  
  try {
    const decoded = jwt.verify(token, secretKey, {
      algorithms: ['HS256', 'RS256'], // Specify allowed algorithms
      issuer: 'your-domain.com',
      audience: 'your-api'
    });
    
    req.user = decoded;
    next();
  } catch (err) {
    if (err.name === 'TokenExpiredError') {
      return res.status(401).json({ message: 'Token expired' });
    }
    if (err.name === 'JsonWebTokenError') {
      return res.status(401).json({ message: 'Invalid token' });
    }
    return res.status(401).json({ message: 'Authentication failed' });
  }
};

// Apply middleware to protected routes
app.get('/api/protected', authenticateJWT, (req, res) => {
  res.json({ data: 'This is protected data', user: req.user });
});

For distributed systems using public key cryptography, implement RS256 with proper key rotation:

const jwt = require('jsonwebtoken');
const fs = require('fs');

const getPublicKey = () => {
  // Support key rotation by trying multiple keys
  const keys = [
    fs.readFileSync('/keys/jwt-public.pem'),
    fs.readFileSync('/keys/jwt-public-old.pem')
  ];
  return keys;
};

const authenticateJWT = (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ message: 'Missing token' });
  }
  
  try {
    const decoded = jwt.verify(token, getPublicKey(), {
      algorithms: ['RS256'],
      issuer: 'your-issuer',
      audience: 'your-audience'
    });
    
    req.user = decoded;
    next();
  } catch (err) {
    return res.status(401).json({ message: 'Authentication failed' });
  }
};

Transport security is equally critical. Always enforce HTTPS and use secure cookie flags:

// Secure cookie configuration
app.use((req, res, next) => {
  if (req.secure || process.env.NODE_ENV === 'development') {
    next();
  } else {
    res.status(403).json({ message: 'HTTPS required' });
  }
});

// Set secure, HTTP-only cookies
res.cookie('jwt', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  maxAge: 3600000 // 1 hour
});

middleBrick's CLI tool helps verify these implementations by scanning your deployed endpoints and identifying authentication weaknesses before attackers can exploit them.