v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.rust.jwt.disable-signature-validation

Validation::insecure_disable_signature_validation() turns off JWT signature verification.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Once disabled, decode accepts any token (including ones forged or tampered with by an attacker) because the cryptographic signature is never checked. For OAuth/OIDC this lets an attacker mint arbitrary access tokens and identities.

Never disable signature validation. Build the validator with the expected algorithm, e.g. Validation::new(Algorithm::HS256) (or the RS/ES algorithm your issuer uses), and verify the token through decode::<Claims>(token, &key, &validation).

VULNERABLE
vulnerable.rs
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;

#[derive(Debug, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,
}

fn decode_unverified(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::HS256);
    // ruleid: auth.rust.jwt.disable-signature-validation
    validation.insecure_disable_signature_validation();
    decode::<Claims>(token, key, &validation).unwrap().claims
}

fn decode_chained(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::default();
    // ruleid: auth.rust.jwt.disable-signature-validation
    let _ = validation.insecure_disable_signature_validation();
    decode::<Claims>(token, key, &validation).unwrap().claims
}
SAFE
safe.rs
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;

#[derive(Debug, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,
}

// ok: auth.rust.jwt.disable-signature-validation -- expected algorithm, signature verified
fn decode_verified(token: &str, key: &DecodingKey) -> Claims {
    let validation = Validation::new(Algorithm::HS256);
    decode::<Claims>(token, key, &validation).unwrap().claims
}

// ok: auth.rust.jwt.disable-signature-validation -- default validation, signature still checked
fn decode_default(token: &str, key: &DecodingKey) -> Claims {
    let validation = Validation::default();
    decode::<Claims>(token, key, &validation).unwrap().claims
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.jwt.disable-signature-validation -- <reason>

References

https://docs.rs/jsonwebtoken/latest/jsonwebtoken/struct.Validation.html#method.insecure_disable_signature_validation ↗https://cwe.mitre.org/data/definitions/347.html ↗