JWT Decode Used for User Identity (Authentication Bypass)

Description

Detects when jwt.decode() output is used for user identity, allowing complete authentication bypass since decode() does not verify signatures.

What Shoulder detects

Authentication bypass via unverified JWT at {sink}.
jwt.decode() does NOT verify the token signature - anyone can forge tokens.
The decoded payload from {source} is assigned to user identity without verification.

How to fix

Use jwt.verify() instead of jwt.decode() for authentication.

```javascript
const decoded = jwt.verify(token, process.env.JWT_SECRET, {
  algorithms: ['HS256']
});
req.user = decoded;
```

Learn more: https://shoulder.dev/learn/javascript/cwe-287/jwt-unverified-user-identity

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express fastify koa hapi nodejs

References

Documentation ↗ OWASP ↗ Learn about CWE-287

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-jwt-unverified-user-identity .