HIGH AI PREVALENCE: MEDIUM auth.csharp.jwt.signature-validator-bypass

A custom `SignatureValidator` on `TokenValidationParameters` returns a parsed token WITHOUT verifying its signature: it just constructs and returns `new JwtSecurityToken(token)` / `new JsonWebToken(token)`.

CWE-347 OWASP API2:2023 C#

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Because the delegate replaces the built-in signature check, any token (including an unsigned or attacker-forged one) is accepted, letting an attacker impersonate any user or role (CWE-347). This is a well-known "make validation pass" hack that AI assistants reproduce from blog posts.

Remove the custom SignatureValidator and let the handler verify signatures with IssuerSigningKey / IssuerSigningKeys (or keys resolved from OIDC metadata). If you truly need a custom validator, it must cryptographically verify the signature and throw on failure, never return a freshly parsed token unchecked.

VULNERABLE

vulnerable.cs

using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public TokenValidationParameters BuildExpression()
    {
        return new TokenValidationParameters
        {
            // ruleid: auth.csharp.jwt.signature-validator-bypass
            SignatureValidator = (token, parameters) => new JwtSecurityToken(token),
        };
    }

    public TokenValidationParameters BuildBlock()
    {
        return new TokenValidationParameters
        {
            // ruleid: auth.csharp.jwt.signature-validator-bypass
            SignatureValidator = (token, parameters) =>
            {
                return new JwtSecurityToken(token);
            },
        };
    }
}

SAFE

safe.cs

using System.Text;
using Microsoft.IdentityModel.Tokens;

public class Startup
{
    // No SignatureValidator override: the handler verifies the signature against
    // the configured signing key. This must not fire.
    public TokenValidationParameters Build(string keyMaterial)
    {
        return new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(keyMaterial)),
            ValidateIssuer = true,
            ValidIssuer = "https://issuer.example.com",
        };
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.jwt.signature-validator-bypass -- <reason>

References

https://learn.microsoft.com/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters.signaturevalidator ↗https://cwe.mitre.org/data/definitions/347.html ↗

A custom SignatureValidator on TokenValidationParameters returns a parsed token WITHOUT verifying its signature: it just constructs and returns new JwtSecurityToken(token) / new JsonWebToken(token).

Why this matters

Suppressing this rule

References

A custom `SignatureValidator` on `TokenValidationParameters` returns a parsed token WITHOUT verifying its signature: it just constructs and returns `new JwtSecurityToken(token)` / `new JsonWebToken(token)`.