> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cryptography

<AccordionGroup>
  <Accordion title="unsigned-security-token">
    Accepting unsigned security tokens as valid security tokens allows an attacker to remove its signature and potentially forge an identity. As a fix, set RequireSignedTokens to be true.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-347: Improper Verification of Cryptographic Signature
    <br />**OWASP**: <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="X509Certificate2-privkey">
    X509Certificate2.PrivateKey is obsolete. Use a method such as GetRSAPrivateKey() or GetECDsaPrivateKey(). Alternatively, use the CopyWithPrivateKey() method to create a new instance with a private key. Further, if you set X509Certificate2.PrivateKey to `null` or set it to another key without deleting it first, the private key will be left on disk. <br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-310: CWE CATEGORY: Cryptographic Issues
    <br />**OWASP**: <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="X509-subject-name-validation">
    Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-295: Improper Certificate Validation
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>
</AccordionGroup>