{"action":"opened","issue":{"url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/244","repository_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt","labels_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/244/labels{/name}","comments_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/244/comments","events_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/244/events","html_url":"https://github.com/GetBlimp/django-rest-framework-jwt/issues/244","id":160551508,"number":244,"title":"Security considerations on the use of username within JWT","user":{"login":"kylef","id":44164,"avatar_url":"https://avatars.githubusercontent.com/u/44164?v=3","gravatar_id":"","url":"https://api.github.com/users/kylef","html_url":"https://github.com/kylef","followers_url":"https://api.github.com/users/kylef/followers","following_url":"https://api.github.com/users/kylef/following{/other_user}","gists_url":"https://api.github.com/users/kylef/gists{/gist_id}","starred_url":"https://api.github.com/users/kylef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kylef/subscriptions","organizations_url":"https://api.github.com/users/kylef/orgs","repos_url":"https://api.github.com/users/kylef/repos","events_url":"https://api.github.com/users/kylef/events{/privacy}","received_events_url":"https://api.github.com/users/kylef/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-16T00:10:21Z","updated_at":"2016-06-16T00:10:21Z","closed_at":null,"body":"Hey,\r\n\r\nI was just evaluating using this library and I noticed that by default it stores a users username in the JWT and this username alone is used to validate the claim by default.\r\n\r\nConsequently this could potentially be a security problem for some users of the library who have implemented change username and/or delete account (where delete will release their username). It may be legal requirement for a user to delete their personal information (UK, Europe, etc) on a web service, so it's extremely likely that web services would offer such functionality. Even if it's not possible to delete an account in the service, there may be a manual mechanism to delete a user by the web services support staff upon a users request.\r\n\r\nI'd suggest adding caution to the documentation or even changing the default behaviour to use the user's ID instead of username in a future release.\r\n\r\n### Steps to reproduce:\r\n\r\n- A developer creates a web service and configures django-rest-framework-jwt using the default instructions.\r\n- A user (Alice) creates an account on the developers web service, perhaps Alice got lucky and registered a common username that was available.\r\n- Alice authenticates with the web service API to acquire a JWT stating Alice owns the username previously registered.\r\n- Then one of the following happens:\r\n    - Alice changes their username to a different username (the web service releases their username).\r\n    - Alice deletes their account (the web service releases their username).\r\n-  Another user (Bob) signs up to the web service using the username that Alice owns a JWT claim for.\r\n- Alice now can authenticate as Bob.\r\n\r\n**NOTE**: *Alice could have targeted Bob specifically and registered a username that would be later used by their intended victim.*"}}
{"actor":{"display_login":"kylef"}}