JWT known Critical vulnerabilities

[stefensuhat]

Hi,

Just wanted to confirm does this package contain JWT known Critical vulnerabilities?

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Thanks for making this package!

[panva]

Silly to have to confirm this way rather than try on your own. This package does not contain any known vulnerabilities.

[trasherdk]

The linked article specifically mentions JOSE 😆

JWT (and JOSE) present the opportunity to have a cross-platform suite of secure cryptography implementations. 
With these fixes, hopefully, we're a little bit closer to making that a reality.

[panva]

Javascript Object Signing and Encryption

[trasherdk]

Close enough. Would have been a nice shout-out though 👀

[panva]

I don't understand your comments. The article does not mention this library, this library didn't even exist at the time it was written. JOSE is the acronym used for the whole JW[STEAK] family of RFCs produced mainly by the JOSE IETF Working Group.

[trasherdk]

Well, it probably won't be the last time I'm wrong about something.