JWT None example app

README.md

JWT None example app

Start the app:

docker compose up -d

Get the JWT:

python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt
python3 ./get_auth_header.py

Then take that header and set it in ZAP.

You can use the openapi-spec.yml to import the API into ZAP for authenticated imports.

References

The docker container for this example app was created using the "02 - None algorithm" example from this repository: https://github.com/agaosto/Vulnerable-JWT

docker-compose.yml

services:
  jwt2:
    container_name: jwt2
    image: insecureapps/vulnerable-jwt-02-none-algorithm:latest
    ports:
      - "5002:5002"
    environment:
      - HOST=localhost
      - PORT=5002
    restart: always

get_auth_header.py

"""Run this to get the authorization header for the test user."""
import requests


def main():
    login_url = f"http://localhost:5002/login"
    response = requests.post(login_url, json={"username": "test", "password": "test"})
    print(f"Headers:")
    print(f"Authorization: Bearer {response.json()['accessToken']}")


if __name__ == '__main__':
    main()

openapi-spec.yml

components: {}
info:
  description: Autogenerated by API ENVY
  title: OpenAPI 3 specification
  version: "0.1"
openapi: 3.0.0
paths:
  /:
    get:
      operationId: root_GET
      responses:
        default:
          description: Default response
      x-name: root_GET
      x-source: app.js~~39
    x-name: root
  /admin:
    get:
      operationId: admin_GET
      responses:
        default:
          description: Default response
      x-name: admin_GET
      x-source: app.js~~52
    x-name: admin
  /login:
    post:
      operationId: login_POST
      requestBody:
        content:
          application/json:
            schema:
              properties:
                password:
                  type: string
                  x-field-kind: normal
                  x-field-original-type: <builtin>.String
                  x-field-type: string
                user:
                  type: string
                  x-field-kind: normal
                  x-field-original-type: <builtin>.String
                  x-field-type: string
              type: object
              x-field-kind: normal
              x-field-original-type: object
              x-field-type: object
        x-code: ""
      responses:
        default:
          description: Default response
      x-name: login_POST
      x-source: app.js~~46
    x-name: login
servers:
  - description: Default server
    url: http://jwt2:5002

requirements.txt

requests