Security Misconfiguration in Chi with Jwt Tokens

Chi is a functional web framework for Clojure that encourages explicit routes and data handling. When JWT tokens are used for authentication without careful configuration, several common security misconfigurations can arise and expose the application.

One misconfiguration is missing or weak token validation. If a Chi application decodes a JWT without verifying the signature, it may trust any payload. For example, using a library without ensuring the correct algorithm and key can allow an attacker to forge tokens by changing the algorithm to none or by supplying a public key as the secret. In Chi routes, this may look like passing the raw token directly to a JWT library call without strict validation, enabling unauthorized access to protected endpoints.

Another misconfiguration is improper storage or transmission of secrets. Chi applications that embed signing secrets in source code or configuration files checked into version control make it easy for attackers to recover the key and sign arbitrary tokens. Additionally, failing to set short expiration times (exp) or not using the nbf (not before) and iat (issued at) claims can lead to tokens being accepted long after they should be invalid.

Transport security misconfiguration is also common. If Chi endpoints that accept or return JWT tokens are served over HTTP instead of HTTPS, tokens can be intercepted in transit. This is especially risky when tokens contain sensitive claims or are used as bearer credentials. Without enforcing HTTPS and setting the Secure flag on tokens, the confidentiality and integrity of JWTs are compromised.

Scope and audience misconfiguration can lead to privilege escalation. A Chi service that issues JWTs for one API audience but accepts them across multiple services without validating the aud claim may allow an attacker to use a token intended for service A to access service B. Similarly, omitting the iss (issuer) check means any issuer-signed token might be trusted, increasing the impact of a compromised signing key.

middleBrick detects these patterns during scans that include Authentication and Input Validation checks. By correlating OpenAPI specifications with runtime behavior, it identifies missing validation steps, weak cryptography settings, and missing transport protections. The scanner reports findings with severity ratings and remediation guidance to help teams tighten their JWT implementation in Chi.

Remediate JWT-related misconfigurations in Chi by enforcing strict validation, protecting secrets, and using secure transport. Below are concrete code examples that demonstrate secure practices.

1. Enforce signature and claim validation

Always validate the token signature and required claims. Use a well-maintained library such as cheshire for JSON handling and clj-jwt for JWT operations. Configure the validation to check the algorithm, issuer, audience, and expiration.

(ns myapp.auth
  (:require [cheshire.core :as json]
            [clj-jwt.core :as jwt]
            [clj-jwt.decode :as decode]
            [clj-time.core :as t]
            [clj-time.coerce :as c]))

(def public-key ;; load your RSA public key securely, e.g., from a trusted source
  (some-fn-from-keystore))

(defn validate-token [token]
  (try
    (let [decoded (decode/decode-token token
                                       {:alg :rs256
                                        :key public-key})]
      (when (and (jwt/validate-decoded decoded)
                 (t/after? (c/from-long (jwt/exp decoded)) (t/now))
                 (t/after? (c/from-long (jwt/nbf decoded)) (t/minus (t/now) (t/hours 1))))
        (jwt/claims decoded))
    (catch Exception _
      nil))) ;; reject invalid tokens

2. Protect the signing key and rotate keys

Store signing keys outside of source code, such as in environment variables or a secrets manager. Rotate keys regularly and implement key sets (JWKS) for multi-key scenarios.

(ns myapp.config
  (:require [cheshire.core :as json])
  (:import (java.nio.file Files Paths)))

(defn get-signing-key
  []
  (or (System/getenv "JWT_SIGNING_KEY")
      (throw (IllegalStateException. "JWT signing key not configured"))))

3. Enforce HTTPS and secure token handling

Serve all Chi endpoints over HTTPS and ensure tokens are marked as Secure and HttpOnly when stored in browsers. In development, use reverse proxies or load balancers to enforce TLS.

(ns myapp.server
  (:require [cheshire.core :as json]
            [ring.util.response :as resp]))

(defn secure-response [body]
  (-> (resp/response body)
      (resp/header "Strict-Transport-Security" "max-age=31536000; includeSubDomains")
      (resp/content-type "application/json")))

4. Validate audience and issuer

Always verify the aud and iss claims to prevent token misuse across services.

(def expected-aud "my-chi-service")
(def expected-iss "https://auth.example.com")

(defn claims-valid? [claims]
  (and (= (:aud claims) expected-aud)
       (= (:iss claims) expected-iss)
       (not (expired? claims))))

5. Use short-lived tokens and refresh strategies

Set a short exp lifetime and use refresh tokens or re-authentication to maintain sessions securely. Avoid long-lived access tokens.

(def access-token-ttl 300) ;; 5 minutes in seconds
(defn make-access-token [payload]
  (jwt/encode (merge payload {:exp (t/plus (t/now) (t/seconds access-token-ttl))})
              (get-signing-key)
              :RS256))