HIGH AI PREVALENCE: MEDIUM auth.csharp.jwt.require-signed-tokens-disabled

A JWT setup sets `RequireSignedTokens = false` on `TokenValidationParameters`.

CWE-347 OWASP API2:2023 C#

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

With signed tokens no longer required, an unsigned token (alg: none, empty signature segment) is returned by the handler as valid, so an attacker can forge tokens with arbitrary claims and no key at all (CWE-347). This is a common AI-generated shortcut to get past a "token is not signed" error during local wiring.

Leave RequireSignedTokens at its secure default (true) so every accepted token must carry a signature that verifies against a trusted key (IssuerSigningKey / keys from OIDC metadata).

VULNERABLE

vulnerable.cs

using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public TokenValidationParameters BuildInitializer()
    {
        return new TokenValidationParameters
        {
            ValidateIssuer = true,
            // ruleid: auth.csharp.jwt.require-signed-tokens-disabled
            RequireSignedTokens = false,
        };
    }

    public void BuildAssignment(TokenValidationParameters parameters)
    {
        // ruleid: auth.csharp.jwt.require-signed-tokens-disabled
        parameters.RequireSignedTokens = false;
    }
}

SAFE

safe.cs

using Microsoft.IdentityModel.Tokens;

public class Startup
{
    // Secure default (true) left in place; signatures are required.
    public TokenValidationParameters Build()
    {
        return new TokenValidationParameters
        {
            ValidateIssuer = true,
            RequireSignedTokens = true,
            ValidateIssuerSigningKey = true,
        };
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.jwt.require-signed-tokens-disabled -- <reason>

References

https://learn.microsoft.com/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters.requiresignedtokens ↗https://cwe.mitre.org/data/definitions/347.html ↗

A JWT setup sets RequireSignedTokens = false on TokenValidationParameters.

Why this matters

Suppressing this rule

References

A JWT setup sets `RequireSignedTokens = false` on `TokenValidationParameters`.