Fix JWT Vulnerabilities (Weak Signing, None Algo) in Actix Web

JWT implementation in Actix Web is a common failure point for Rust developers. If you're accepting the 'none' algorithm or using a weak secret, your authentication is paper-thin. Real-world exploitation involves header manipulation to bypass signature verification entirely. This guide covers how to harden your Actix middleware by enforcing strong cryptographic signing and rejecting insecure headers.

The Vulnerable Pattern

use jsonwebtoken::{decode, DecodingKey, Validation, Algorithm};
// VULNERABLE: This code accepts weak secrets and could be misconfigured to allow ‘none’ alg
fn verify_token(token: &str) {
let secret = “secret123”; // Weak, hardcoded secret
let mut validation = Validation::new(Algorithm::HS256);
// If a dev accidentally uses Validation::dangerous(), all security is lost
let token_data = decode::(
token,
&DecodingKey::from_secret(secret.as_ref()),
&validation
);
}

The Secure Implementation

1. Algorithm Enforcement: By explicitly passing Algorithm::HS256 to the Validation struct, the jsonwebtoken crate will reject any token with 'alg: none' or mismatched algorithms. 2. Secret Entropy: We moved the secret to an environment variable. In production, this should be a 256-bit base64 encoded string to prevent brute-force attacks. 3. Claim Validation: Enabling validate_exp ensures that expired tokens are rejected even if the signature is valid, preventing replay attacks. 4. Error Handling: The secure implementation returns a Result, allowing the Actix middleware to properly return a 401 Unauthorized instead of panicking or failing silently.

use jsonwebtoken::{decode, DecodingKey, Validation, Algorithm};
use std::env;
// SECURE: Enforce specific algorithms, use high-entropy secrets, and validate claims
fn verify_token_secure(token: &str) -> Result<Claims, String> {
let secret = env::var(“JWT_SECRET”).map_err(|_| “Missing JWT_SECRET”)?;
// Explicitly whitelist only secure algorithms
let mut validation = Validation::new(Algorithm::HS256);
validation.validate_exp = true;
validation.leeway = 60;

decode::<Claims>(
    token,
    &DecodingKey::from_secret(secret.as_ref()),
    &validation
)
.map(|data| data.claims)
.map_err(|e| format!("Invalid token: {}", e))
}