eslint-plugin-jwt-security 2.3.0 → 2.3.1

package/dist/package.json

@@ -1,125 +0,0 @@
-{
-  "name": "eslint-plugin-jwt-security",
-  "version": "2.3.0",
-  "description": "ESLint plugin for JWT security — detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
-  "type": "commonjs",
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.d.ts",
-      "default": "./src/index.js"
-    },
-    "./types": {
-      "types": "./src/types/index.d.ts",
-      "default": "./src/types/index.js"
-    },
-    "./oxlint": {
-      "types": "./src/oxlint.d.ts",
-      "default": "./src/oxlint.js"
-    }
-  },
-  "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
-  "license": "MIT",
-  "homepage": "https://eslint.interlace.tools/docs/security/plugin-jwt-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security-security",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/ofri-peretz/eslint",
-    "directory": "packages/eslint-plugin-jwt-security"
-  },
-  "bugs": {
-    "url": "https://github.com/ofri-peretz/eslint/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "files": [
-    "src/",
-    "dist/",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "AGENTS.md"
-  ],
-  "keywords": [
-    "eslint",
-    "eslintplugin",
-    "eslint-plugin",
-    "static-analysis",
-    "linting",
-    "code-quality",
-    "security",
-    "sast",
-    "appsec",
-    "vulnerability",
-    "owasp",
-    "cwe",
-    "interlace-security",
-    "jwt",
-    "json-web-token",
-    "jwt-security",
-    "jsonwebtoken",
-    "jose",
-    "express-jwt",
-    "nestjs-jwt",
-    "jwks-rsa",
-    "jwt-decode",
-    "algorithm-confusion",
-    "cve-2022-23540",
-    "cwe-347",
-    "cwe-757",
-    "token",
-    "authentication",
-    "authorization",
-    "llm-optimized",
-    "ai-assistant",
-    "typescript",
-    "auto-fix",
-    "auth-security",
-    "token-security"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.3"
-  },
-  "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
-  },
-  "peerDependenciesMeta": {
-    "jsonwebtoken": {
-      "optional": true
-    },
-    "@nestjs/jwt": {
-      "optional": true
-    },
-    "express-jwt": {
-      "optional": true
-    },
-    "jose": {
-      "optional": true
-    },
-    "jwks-rsa": {
-      "optional": true
-    },
-    "jwt-decode": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@typescript-eslint/parser": "^8.46.2",
-    "@typescript-eslint/rule-tester": "^8.46.2"
-  },
-  "scripts": {
-    "build": "tsx ../../scripts/build-package.ts",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
-  },
-  "funding": {
-    "type": "github",
-    "url": "https://github.com/ofri-peretz/eslint"
-  }
-}

package/dist/src/index.d.ts

@@ -1,101 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * eslint-plugin-jwt-security
- *
- * Comprehensive JWT security ESLint plugin for Node.js applications.
- * Detects vulnerabilities across jsonwebtoken, jose, express-jwt,
- * @nestjs/jwt, jwks-rsa, and jwt-decode libraries.
- *
- * Features:
- * - Algorithm confusion attack detection (CVE-2022-23540)
- * - "Back to the Future" replay attack prevention (LightSEC 2025)
- * - Signature verification enforcement
- * - Weak secret detection
- * - Expiration and claim validation
- * - AI-assisted fix guidance with CWE references
- *
- * @see https://tools.ietf.org/html/rfc8725
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import { noAlgorithmNone } from './rules/no-algorithm-none';
-import { noAlgorithmConfusion } from './rules/no-algorithm-confusion';
-import { requireAlgorithmWhitelist } from './rules/require-algorithm-whitelist';
-import { noDecodeWithoutVerify } from './rules/no-decode-without-verify';
-import { noWeakSecret } from './rules/no-weak-secret';
-import { requireExpiration } from './rules/require-expiration';
-import { noHardcodedSecret } from './rules/no-hardcoded-secret';
-import { requireIssuedAt } from './rules/require-issued-at';
-import { requireIssuerValidation } from './rules/require-issuer-validation';
-import { requireAudienceValidation } from './rules/require-audience-validation';
-import { noTimestampManipulation } from './rules/no-timestamp-manipulation';
-import { requireMaxAge } from './rules/require-max-age';
-import { noSensitivePayload } from './rules/no-sensitive-payload';
-/**
- * Collection of all JWT security ESLint rules (13 rules)
- */
-export declare const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
-/**
- * ESLint Plugin object
- */
-export declare const plugin: TSESLint.FlatConfig.Plugin;
-/**
- * Configuration presets for flat config
- */
-export declare const configs: {
-    /**
-     * Flagship preset — the rule from this plugin in the ecosystem-wide
-     * flagship list (`.agent/flagship-rules.md`). Use this when you want
-     * the highest-signal JWT subset shippable in CI gates.
-     */
-    flagship: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: {
-            'jwt/no-algorithm-none': "error";
-        };
-    };
-    /**
-     * Recommended preset - balanced security
-     */
-    recommended: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-    /**
-     * Strict preset - maximum security (includes 2025 research)
-     */
-    strict: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-    /**
-     * Legacy preset - migration mode
-     */
-    legacy: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-    /**
-     * All rules preset
-     */
-    all: {
-        plugins: {
-            jwt: TSESLint.FlatConfig.Plugin;
-        };
-        rules: Record<string, TSESLint.SharedConfig.RuleEntry>;
-    };
-};
-export default plugin;
-export { noAlgorithmNone, noAlgorithmConfusion, requireAlgorithmWhitelist, noDecodeWithoutVerify, noWeakSecret, requireExpiration, noHardcodedSecret, requireIssuedAt, requireIssuerValidation, requireAudienceValidation, noTimestampManipulation, requireMaxAge, noSensitivePayload, };

package/dist/src/oxlint.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-import { plugin } from './index';
-export = plugin;

package/dist/src/oxlint.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-jwt-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-jwt-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-const index_1 = require("./index");
-module.exports = index_1.plugin;

package/dist/src/rules/no-algorithm-confusion/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-algorithm-confusion
- *
- * Detects algorithm confusion attacks where symmetric algorithms (HS256/384/512)
- * are used with asymmetric keys (public keys). This allows attackers to sign
- * tokens using the public key as an HMAC secret.
- *
- * CWE-347: Improper Verification of Cryptographic Signature
- *
- * @see https://portswigger.net/web-security/jwt/algorithm-confusion
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoAlgorithmConfusionOptions } from '../../types';
-type MessageIds = 'algorithmConfusion' | 'symmetricWithPublicKey' | 'useAsymmetricAlgorithm';
-type RuleOptions = [NoAlgorithmConfusionOptions?];
-export declare const noAlgorithmConfusion: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noAlgorithmConfusion;

package/dist/src/rules/no-algorithm-none/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-algorithm-none
- *
- * Detects attempts to use the 'none' algorithm which bypasses JWT signature verification.
- * This is a critical vulnerability (CVE-2022-23540) that allows attackers to forge JWT tokens.
- *
- * CWE-347: Improper Verification of Cryptographic Signature
- *
- * @see https://nvd.nist.gov/vuln/detail/CVE-2022-23540
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoAlgorithmNoneOptions } from '../../types';
-type MessageIds = 'algorithmNone' | 'algorithmNoneInArray' | 'emptyAlgorithms' | 'useSecureAlgorithm' | 'decodeWithoutVerify';
-type RuleOptions = [NoAlgorithmNoneOptions?];
-export declare const noAlgorithmNone: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noAlgorithmNone;

package/dist/src/rules/no-decode-without-verify/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-decode-without-verify
- *
- * Detects usage of jwt.decode() or jwt-decode library without corresponding
- * verification. Decoded JWTs can be tampered with by attackers.
- *
- * CWE-345: Insufficient Verification of Data Authenticity
- *
- * @see https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoDecodeWithoutVerifyOptions } from '../../types';
-type MessageIds = 'decodeWithoutVerify' | 'jwtDecodeLibrary' | 'useVerifyInstead';
-type RuleOptions = [NoDecodeWithoutVerifyOptions?];
-export declare const noDecodeWithoutVerify: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noDecodeWithoutVerify;

package/dist/src/rules/no-hardcoded-secret/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-hardcoded-secret
- *
- * Detects hardcoded secrets in JWT sign/verify operations.
- * Hardcoded secrets in source code are a critical security vulnerability.
- *
- * CWE-798: Use of Hard-coded Credentials
- *
- * @see https://cwe.mitre.org/data/definitions/798.html
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoHardcodedSecretOptions } from '../../types';
-type MessageIds = 'hardcodedSecret' | 'useEnvVariable';
-type RuleOptions = [NoHardcodedSecretOptions?];
-export declare const noHardcodedSecret: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noHardcodedSecret;

package/dist/src/rules/no-sensitive-payload/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-sensitive-payload
- *
- * Detects storage of sensitive data in JWT payload.
- * JWT payloads are only base64-encoded, not encrypted.
- *
- * CWE-359: Exposure of Private Personal Information
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoSensitivePayloadOptions } from '../../types';
-type RuleOptions = [NoSensitivePayloadOptions?];
-export declare const noSensitivePayload: TSESLint.RuleModule<"sensitivePayloadField", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noSensitivePayload;

package/dist/src/rules/no-timestamp-manipulation/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-timestamp-manipulation
- *
- * Detects patterns that disable automatic timestamp (iat) generation.
- * This enables the "Back to the Future" replay attack (LightSEC 2025).
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { JwtRuleOptions } from '../../types';
-type MessageIds = 'timestampDisabled' | 'noTimestampTrue';
-type RuleOptions = [JwtRuleOptions?];
-export declare const noTimestampManipulation: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noTimestampManipulation;

package/dist/src/rules/no-weak-secret/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: no-weak-secret
- *
- * Detects weak secrets used for HMAC-based JWT signing.
- * Weak secrets can be brute-forced, allowing attackers to forge tokens.
- *
- * CWE-326: Inadequate Encryption Strength
- *
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { NoWeakSecretOptions } from '../../types';
-type MessageIds = 'weakSecret' | 'shortSecret' | 'useStrongSecret';
-type RuleOptions = [NoWeakSecretOptions?];
-export declare const noWeakSecret: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default noWeakSecret;

package/dist/src/rules/require-algorithm-whitelist/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-algorithm-whitelist
- *
- * Enforces explicit algorithm specification in JWT verify operations.
- * Without explicit algorithms, the token's header algorithm is trusted,
- * enabling algorithm substitution attacks.
- *
- * CWE-757: Selection of Less-Secure Algorithm During Negotiation
- *
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireAlgorithmWhitelistOptions } from '../../types';
-type MessageIds = 'missingAlgorithmWhitelist' | 'addAlgorithmWhitelist';
-type RuleOptions = [RequireAlgorithmWhitelistOptions?];
-export declare const requireAlgorithmWhitelist: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireAlgorithmWhitelist;

package/dist/src/rules/require-audience-validation/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-audience-validation
- *
- * Mandates audience (aud) claim validation in JWT verify operations.
- * Without audience validation, tokens intended for other services are accepted.
- *
- * CWE-287: Improper Authentication
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireAudienceValidationOptions } from '../../types';
-type RuleOptions = [RequireAudienceValidationOptions?];
-export declare const requireAudienceValidation: TSESLint.RuleModule<"missingAudienceValidation", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireAudienceValidation;

package/dist/src/rules/require-expiration/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-expiration
- *
- * Mandates expiration claim (exp) or expiresIn option in JWT sign operations.
- * Tokens without expiration are valid forever, creating security risks.
- *
- * CWE-613: Insufficient Session Expiration
- *
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireExpirationOptions } from '../../types';
-type MessageIds = 'missingExpiration' | 'addExpiration';
-type RuleOptions = [RequireExpirationOptions?];
-export declare const requireExpiration: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireExpiration;

package/dist/src/rules/require-issued-at/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-issued-at
- *
- * Mandates the `iat` (issued at) claim in JWT tokens for freshness validation.
- * Without `iat`, tokens cannot be validated for age, enabling the
- * "Back to the Future" replay attack (LightSEC 2025).
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { JwtRuleOptions } from '../../types';
-type RuleOptions = [JwtRuleOptions?];
-export declare const requireIssuedAt: TSESLint.RuleModule<"missingIssuedAt", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireIssuedAt;

package/dist/src/rules/require-issuer-validation/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-issuer-validation
- *
- * Mandates issuer (iss) claim validation in JWT verify operations.
- * Without issuer validation, tokens from any issuer are accepted.
- *
- * CWE-287: Improper Authentication
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireIssuerValidationOptions } from '../../types';
-type RuleOptions = [RequireIssuerValidationOptions?];
-export declare const requireIssuerValidation: TSESLint.RuleModule<"missingIssuerValidation", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireIssuerValidation;

package/dist/src/rules/require-max-age/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-max-age
- *
- * Mandates maxAge option in JWT verify operations to enforce token freshness.
- * This prevents the "Back to the Future" replay attack where tokens are
- * captured and replayed months or years later.
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- * @see LightSEC 2025 - "JWT Back to the future: On the (ab)use of JWTs"
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { JwtRuleOptions } from '../../types';
-type RuleOptions = [JwtRuleOptions?];
-export declare const requireMaxAge: TSESLint.RuleModule<"missingMaxAge", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireMaxAge;

package/dist/src/types/index.js

@@ -1,7 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });