Tools and techniques for analyzing JWT tokens for authentication vulnerabilities.

JWT Overview

JSON Web Tokens (JWT) are commonly used for authentication but can introduce security issues if not implemented correctly.

Common Vulnerabilities

Algorithm Confusion (alg: none)

# Exploit: Change alg to "none" and remove signature
header = {"alg": "none", "typ": "JWT"}
payload = {"sub": "1234567890", "role": "admin"}

Key Confusion (RS256 to HS256)

If the server uses RS256 but the library accepts HS256 with the public key as the secret.

Analysis Tools

  • JWT.io for manual inspection
  • Custom Python scripts for batch analysis
  • Burp Suite extension for runtime inspection

Validation Checklist

  1. Verify signature with correct algorithm
  2. Check token expiration (exp claim)
  3. Validate audience (aud claim)
  4. Ensure proper key management
  5. Use strong secret keys (256-bit minimum)

Best Practices

  • Always validate algorithm expected by your application
  • Use asymmetric algorithms (RS256) when possible
  • Implement token rotation
  • Set appropriate expiration times