mcp-server-semgrep/semgrep-rules/javascript/jsonwebtoken/security/audit/jwt-decode-without-verify.jsx

MCP Server for Semgrep Integration - static code analysis with AI

const jwt = require('jsonwebtoken');

const bad = (token) => {
  // ruleid: jwt-decode-without-verify
  if (jwt.decode(token, true).param === true) {
    console.log('token is valid');
  }
};

const ok = (token, key) => {
  // ok: jwt-decode-without-verify
  jwt.verify(token, key);
  if (jwt.decode(token, true).param === true) {
    console.log('token is valid');
  }
};