JWT Information leak of User object about production-saas HOT 4 OPEN

Just a quick note on the above... I've noticed why the SALT is included in the token (

Need another solution to replace that line.

from production-saas.

Email/uid and salt should be the only things contained in the JWT payload. One piece of public identifiable info (immutable) and a “salt” that is a psssword stand in. When a password is changed, so is salt so that all existing JWTs are immediately invalidated.

from production-saas.

Email/uid and salt should be the only things contained in the JWT payload. One piece of public identifiable info (immutable) and a “salt” that is a psssword stand in. When a password is changed, so is salt so that all existing JWTs are immediately invalidated.

As it stands, everything from User object is included; even the password. Fairly easy to brute force it since we also have the SALT.

On another note, I've checked many JWT aware apps including Netlify, none of them include SALT in the JWT. For the condition payload.salt !== user.salt I'm thinking of an alternative and testing.

from production-saas.

A “salt” alike is the way to go.

I don’t work at CF anymore. Feel free to open a PR to fix the User object inclusion.

from production-saas.