v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.ruby.jwt.decode-verify-disabled

JWT.decode is called with its third positional argument set to false, which disables signature verification entirely.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

The library will happily return the claims of any token, including one an attacker forged, so any authorization decision made on the decoded sub / role / scope is trivially bypassed (CWE-347). This is a common AI-generated mistake: the assistant "just wants the payload" and turns verification off to make the call succeed.

Verify the signature and pin the algorithm instead: JWT.decode(token, key, true, { algorithm: 'HS256' }) For asymmetric tokens pass the public key and an algorithms: allow-list.

VULNERABLE
vulnerable.rb
require 'jwt'

class SessionController < ApplicationController
  def current_user_id
    token = request.headers['Authorization'].to_s.split(' ').last
    # ruleid: auth.ruby.jwt.decode-verify-disabled
    payload, = JWT.decode(token, nil, false)
    payload['sub']
  end

  def admin?
    token = cookies[:jwt]
    # ruleid: auth.ruby.jwt.decode-verify-disabled
    decoded = JWT.decode(token, ENV['JWT_SECRET'], false, { algorithm: 'HS256' })
    decoded.first['role'] == 'admin'
  end
end
SAFE
safe.rb
require 'jwt'

class SessionController < ApplicationController
  def current_user_id
    token = request.headers['Authorization'].to_s.split(' ').last
    # ok: verification is on and the algorithm is pinned
    payload, = JWT.decode(token, ENV.fetch('JWT_SECRET'), true, { algorithm: 'HS256' })
    payload['sub']
  end
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.jwt.decode-verify-disabled -- <reason>

References

https://github.com/jwt/ruby-jwt ↗https://cwe.mitre.org/data/definitions/347.html ↗