3 Ways JWTs Get Forged, and the One Rule That Stops Them All

JSON Web Tokens are the default bearer credential of the modern web. They sit in your Authorization header, in cookies, in the calls your services make to each other. And most of the time they work quietly, which is exactly the problem. A JWT that is signed with the secret secret looks identical to one signed with a 256 bit random key, right up until someone runs a wordlist against it and starts minting admin tokens.

I spend a lot of time looking at tokens, so let me walk through the three ways I actually try to forge one, why each works, and the single defensive habit that closes all three at once. I will use a small tool I built, jwt-auditor, to show each attack against a real token.

First, a thirty-second refresher. A JWT is three base64url pieces joined by dots: a header, a payload, and a...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE