Missing protection claims: jti or nonce

Question

Missing protection claims: jti or nonce

Kris121 1

Our DAST tool flags the JWT token as vulnerable because of Missing protection claims: jti or nonce. What is the remediation for this. How to add jti or nonce in JWT token.

Shashi Shailaj 7,631 Reputation points Microsoft Employee Moderator

2021-04-08T13:49:31.9+00:00

@Siva-9848 , In the ID token provided by Azure AD which uses JWT formatting, nonce is always there and jti is optional . However , it would be great if you could provide the details as to how the DAST application checks the same and what oAuth flow was used to obtain the token ?
Kris121 1 Reputation point

2021-05-17T09:41:17.873+00:00

Hi Shashi,

These are API Access Tokens either obtained via the on-behalf-of flow (in the case of use-based tokens) or client credentials (in the case of application-based tokens).

DAST tool (webinspect) will just decode the token and verify what claims are present in the payload/header.

Your answer

Shashi Shailaj 7,631 Reputation points Microsoft Employee Moderator

2021-04-08T13:49:31.9+00:00

@Siva-9848 , In the ID token provided by Azure AD which uses JWT formatting, nonce is always there and jti is optional . However , it would be great if you could provide the details as to how the DAST application checks the same and what oAuth flow was used to obtain the token ?
Kris121 1 Reputation point

2021-05-17T09:41:17.873+00:00

Hi Shashi,

These are API Access Tokens either obtained via the on-behalf-of flow (in the case of use-based tokens) or client credentials (in the case of application-based tokens).

DAST tool (webinspect) will just decode the token and verify what claims are present in the payload/header.

Share via

Missing protection claims: jti or nonce

Your answer