{"action":"closed","issue":{"url":"https://api.github.com/repos/jpadilla/pyjwt/issues/233","repository_url":"https://api.github.com/repos/jpadilla/pyjwt","labels_url":"https://api.github.com/repos/jpadilla/pyjwt/issues/233/labels{/name}","comments_url":"https://api.github.com/repos/jpadilla/pyjwt/issues/233/comments","events_url":"https://api.github.com/repos/jpadilla/pyjwt/issues/233/events","html_url":"https://github.com/jpadilla/pyjwt/issues/233","id":194201029,"number":233,"title":"Encrypt tokens","user":{"login":"daredevil82","id":1406974,"avatar_url":"https://avatars2.githubusercontent.com/u/1406974?v=3","gravatar_id":"","url":"https://api.github.com/users/daredevil82","html_url":"https://github.com/daredevil82","followers_url":"https://api.github.com/users/daredevil82/followers","following_url":"https://api.github.com/users/daredevil82/following{/other_user}","gists_url":"https://api.github.com/users/daredevil82/gists{/gist_id}","starred_url":"https://api.github.com/users/daredevil82/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daredevil82/subscriptions","organizations_url":"https://api.github.com/users/daredevil82/orgs","repos_url":"https://api.github.com/users/daredevil82/repos","events_url":"https://api.github.com/users/daredevil82/events{/privacy}","received_events_url":"https://api.github.com/users/daredevil82/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-07T23:13:40Z","updated_at":"2017-03-05T04:17:37Z","closed_at":"2017-03-05T04:17:37Z","body":"Reading the documentation, one can be excused if the impression is given that the contents of a JWT are encrypted during the encoding process.  However, they are not, and if a developer includes sensitive information in the payload of a token, it is _very_ easy to retrieve the data.\r\n\r\n\timport jwt, base64\r\n\r\n\ttoken = jwt.encode({'some':'payload'}, 'secret', algorithm='HS512')\r\n\talgo, text, signature = token.split(b'.')\r\n\tdecoded_text = base64.decodebytes(text)\r\n\tprint(decoded_text)\r\n\t> b'{\"some\":\"payload\"}\r\n\r\nIn fact, you don't even need to split the token up to get the information!\r\n\r\n    In [10]: base64.decodebytes(token)\r\n    Out[10]: b'{\"typ\":\"JWT\",\"alg\":\"HS512\"}{\"some\":\"payload\"}\\x12\\x03\\'\\xcd\\xc2X\\xacIN7OA\\xc0\\xec\\x1a\\xa9\\x16{\\n\\xad\\xf4\\x9f\\xb7 M\\x91\\x89\\xaa\\xd2\\xb5`w\\xc6\\xd5\\xc1\\xa7\\x18\\x9a\\t\\x1b\\x03\\x8b\\x8f\\xa0\\x16\\x83\\xdbZ;\"M\\xdc9\\xeaw\\xd3Wy0\\xa3L,\\x00'\r\n\r\nThis is a very significant issue, since the encoding process gives a false sense of security."}}
{"actor":{"display_login":"mark-adams"}}