Type cast error in sample code at JWT token section

[jp3pe]

Test environment

java: zulu-17
Build: Gradle
Added dependencies: (io.jsonwebtoken:jjwt:0.9.1', javax.xml.bind:jaxb-api:2.3.1)

Location

JWT tokens section-7th problem-second sample code
/WebGoat/start.mvc#lesson/JWT.lesson/6

Issue

At the second sample code on the page, the code convert claims.get("admin") to (String).
I ran the code and it return the error class java.lang.Boolean cannot be cast to class java.lang.String

Solution

Change Boolean.valueOf((String) claims.get("admin")) to Boolean.valueOf(String.valueOf(claims.get("admin")))

PS

I'm not good at Java and Web security.
If the issue was occurred by a different JVM version or my misunderstanding, please ignore it.

[github-actions]

Thanks for submitting your first issue, we will have a look as quickly as possible.

[nbaars]

@jp3pe the code is also part of the Java code in JWTVotesEndpoint we use:

Jwt jwt = Jwts.parser().setSigningKey(JWT_PASSWORD).parse(accessToken);
Claims claims = (Claims) jwt.getBody();
boolean isAdmin = Boolean.valueOf((String) claims.get("admin"));

can you share your code?

[nbaars]

Looking at the issue again, the issue is:

{
  "admin": true
}

updated the code accordingly. @jp3pe thanks for raising this issue.

[nbaars]

Closing as we released 2023.3