New multi-file app

[try-panwiac]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  Ensure Usage of JWT Algo
    Source File: UseEnsureJwtAlgo.js, Sink File: DefEnsureJwtAlgo.js | Checkov ID: CKV3_SAST_146

Data Flow

     UseEnsureJwtAlgo.js
     3 | let myInSecureAlgo = { algorithm: 'none' }
     UseEnsureJwtAlgo.js
     6 | GenerateJWT(myInSecureAlgo);
     DefEnsureJwtAlgo.js
    10 | const token = jwt.sign(payload, SECRET, algo);

Description

CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
OWASP: A02:2021-Cryptographic Failures

This policy detects the usage of JWT (JSON Web Token) with a non-secure algorithm.

Vulnerable code example:

const jwt = require('jsonwebtoken');

const payload = {
  user: 'admin',
  role: 'admin'
};

const token = jwt.sign(payload, 'secret', { algorithm: 'none' });

console.log(token);

In the above code, the algorithm option for JWT signing is set to 'none'. This means that the JWT token is not encrypted and can be easily tampered with or read by unauthorized parties.