Python FastAPI: JWT signature is never verified, so any token is accepted

Authentication is implemented as a FastAPI dependency used by every protected route. It decodes the JWT, but disables signature verification, probably left over from debugging:

# auth.py (vulnerable)
import jwt
from fastapi import Depends, HTTPException
from fastapi.security import HTTPBearer

bearer = HTTPBearer()

def get_current_user(cred = Depends(bearer)):
    try:
        claims = jwt.decode(cred.credentials, options={"verify_signature": False})
    except jwt.PyJWTError:
        raise HTTPException(401)
    return User(id=claims["sub"], role=claims["role"])   # role taken from the token

A JWT is only meaningful if its signature is checked. With verification disabled, the token is just attacker-supplied JSON, and the server then takes both the identity (sub) and the privilege (role) from it. The expiry is not checked either, so a forged token never expires.

Reproduced against a local copy of the API, using an arbitrary key that the server has never seen.

$ python3 -c 'import jwt; print(jwt.encode({"sub":"1","role":"admin"}, "any-key", algorithm="HS256"))'
<token>

$ curl -s https://api.plankdesigns.co/api/v1/admin/export -H "Authorization: Bearer <token>"
HTTP/1.1 200 OK       # accepted; no valid credential was needed

The export response was not read; the status code alone confirmed the bypass.

Verify the signature with the server's key, pin the allowed algorithm, require the expiry, and read the role from the database instead of the token.

# auth.py (fixed)
def get_current_user(cred = Depends(bearer), db = Depends(get_db)):
    try:
        claims = jwt.decode(
            cred.credentials,
            settings.JWT_SECRET,                 # from a secret store, not source code
            algorithms=["HS256"],                # pin; never accept "none"
            audience="api.plankdesigns.co",
            options={"require": ["exp", "sub", "aud"]},
        )
    except jwt.PyJWTError:
        raise HTTPException(401)
    user = db.get(User, claims["sub"])           # current role comes from the database
    if user is None or user.disabled:
        raise HTTPException(401)
    return user

• Rotate the signing secret and invalidate existing sessions, because forged tokens may already have been issued.
• Prefer asymmetric signing (for example RS256 or EdDSA) so services that verify tokens do not hold the signing key.
• Add a test that sends a token signed with the wrong key and expects 401.
• Search for other uses of verify_signature set to false, and for other places that trust claims without verification.