fix(auth): prevent false positives in JWT-none and expired-JWT tests on public endpoints

[GovindarajanL]

Problem

The JWT none algorithm test (ASTF-API2-2023) was producing massive false positives — 548 CRITICAL findings — when scanning Rocket.Chat's public open.rocket.chat instance.

Root Cause

Both testJwtNoneAlgorithm and testExpiredJwt only checked endpoint.isRequiresAuthentication() (which defaults to true for all inline YAML endpoints) but never verified at runtime whether the endpoint actually demands authentication.

Public endpoints like /api/info and /api/v1/settings.public return HTTP 200 to all requests — with or without a token. The test sent a JWT-none token, saw HTTP 200, and flagged CRITICAL — but the 200 had nothing to do with the token.

Proof: Manual curl with JWT-none token against auth-required endpoints (e.g. /api/v1/me) correctly returns 401. The scanner's findings were wrong.

Fix

Added a baseline probe (no Authorization header) before each JWT attack probe in both methods:

Baseline (no auth)  →  2xx  →  endpoint is public  →  SKIP (would be false positive)
Baseline (no auth)  →  4xx  →  endpoint requires auth  →  proceed with JWT-none probe
JWT-none probe      →  2xx  →  CRITICAL finding raised (genuine bypass confirmed)
JWT-none probe      →  4xx  →  no finding (correctly rejected)

The finding evidence now also includes the baseline HTTP status:

"Server returned HTTP 200 when presented with a JWT using 'none' algorithm (baseline without auth: HTTP 401)"

Tests

• BrokenAuthenticationTestcaseTest: 3 new tests

  • testJwtNoneAlgorithmNoFalsePositiveOnPublicEndpoint — public endpoint must NOT trigger JWT-none finding
  • testJwtNoneEvidenceIncludesBaselineStatus — evidence must mention baseline status
  • testJwtNoneAlgorithmDetection — pre-existing test still passes (realistic mock: 401 baseline / 200 with JWT-none)

• BrokenAuthenticationExtendedTest: 2 new tests + 1 mock fix

  • testExpiredJwtNoFalsePositiveOnPublicEndpoint — same false-positive prevention for expired-JWT test
  • testExpiredJwtAccepted mock updated to be realistic (was: always 200; now: 401 baseline / 200 with auth header)

232/232 tests pass.

Impact

Before this fix, scanning any server that has public endpoints would produce hundreds of spurious CRITICAL findings, making the report useless and undermining trust in ASTF. After this fix, findings are only raised when auth bypass is genuinely demonstrated.

🤖 Generated with Claude Code