who am i?

# Experience

title: TheDouble-EdgedSwordofSecurityProtocol
date: 2024-05-13 10:27:03
tags:

Navigating the Complexity of JWTs in Security

JSON Web Tokens (JWTs) are often seen as the modern solution to the complexities of older security protocols like SAML. But while they offer simplicity, there’s more than meets the eye. Let’s break down the ins and outs of JWTs.

Looking Back: SAML

Security Assertion Markup Language (SAML) was once the go-to for security, but it had its fair share of complications. Written in XML, it was flexible but prone to vulnerabilities like XXE and SSRF.

Introducing JWTs

JWTs came onto the scene as a simpler alternative to SAML. They boasted:

• Ease: With JSON’s straightforward structure, they were a breeze compared to XML.

• No More Complexity: Say goodbye to the headaches of dealing with canonicalization.

• Flexibility: They could easily adapt to different cryptographic algorithms.

The Hidden Challenges

However, beneath JWTs’ simplicity lie some challenges:

1. Cryptographic Delicacy: While it’s nice to switch cryptographic algorithms, it can also make things fragile. Choosing the wrong algorithm or a tiny misconfiguration can lead to big problems.

2. Algorithm Hijinks: Blindly trusting the ‘alg’ header in a JWT can backfire. Hackers can manipulate this header, slipping in fake tokens unnoticed.

3. Never-Ending Validity: Many JWTs stay valid forever unless configured otherwise. This oversight can turn them into ticking time bombs.

4. Wide Attack Surface: Validating a JWT involves multiple steps, each of which could be a vulnerability waiting to be exploited.

In Summary

JWTs offer simplicity, but they’re not without their challenges. When it comes to security, it’s important to weigh the pros and cons carefully. Security should be built into the system from the ground up, not tacked on as an afterthought.

# Secure Software Development

Recently, while I was studying, I came across the concept of mutable/imutable objects.

In this blog post, I will try explain the security perspective and importance of immutability, by taking an example of Java’s LocalDate and older Date library. We’ll also explore the potential security risks of passing mutable objects and how immutability can help mitigate these risks.

#What Are Mutable and Immutable Objects?

In the world of programming, objects can be categorized as mutable or immutable based on whether their state can be changed after they are created.

• Mutable Objects: These are objects whose state can be modified after their creation. When you change the properties or attributes of a mutable object, it can lead to unexpected side effects and security vulnerabilities.
• Immutable Objects: In contrast, immutable objects are objects whose state cannot be changed after they are created. They maintain a consistent, unalterable state throughout their lifetime.

#The Beauty of Immutability

Let’s explore the benefits of immutability by looking at two commonly used date-related libraries in Java: LocalDate and the older Date class.

• LocalDate: An Immutable Date Representation
  LocalDate is part of the java.time package introduced in Java 8. It represents a date without a time component and is immutable by design. Here’s an example of how LocalDate works:

1
2
3
4
5
6
7
8
9
10
11
12

import java.time.LocalDate;

public class ImmutableDateExample {
    public static void main(String[] args) {
        LocalDate date = LocalDate.of(2023, 11, 6);
        System.out.println("Original Date: " + date);

        // Attempting to modify the date
        // will result in a compilation error
        // date.plusDays(1);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13

import java.util.Date;

public class MutableDateExample {
    public static void main(String[] args) {
        Date date = new Date();

        System.out.println("Original Date: " + date);

        // Modifying the date by adding 1 day
        date.setTime(date.getTime() + 24 * 60 * 60 * 1000);
        System.out.println("Modified Date: " + date);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

import java.time.LocalDate;

public class ImmutableDateExample {
    public static void main(String[] args) {
        LocalDate date = LocalDate.of(2023, 11, 6);

        // Getters are safe to use
        int year = date.getYear();
        int month = date.getMonthValue();
        int day = date.getDayOfMonth();

        // But never expose setters for immutable objects
        // date.setYear(2024); // This will not compile
    }
}

# What is vulnerability Management?

In this blog post, I want to bring the idea behind vulnerability Management and security tooling which is not just a buzzword anymore;

Vulnerability Management is a regular practice of identifying, prioritizing, and remidiating vulnerabilities and missconfigurations.

It’s a vital component of modern cybersecurity. Whether you’re just starting to build your organization’s security strategy or have already implemented vulnerablity management, it’s important to understand its significance and incorporate it as an ongoing process in your cybersecurity framework.

# Common challenges accross industries

# What are the best practices