The Hacker's Guide to JWT Security
summary
Four live demos expose practical JWT failures: acceptance of the none algorithm due to misleading library APIs, an HS256 secret cracked in ~15–20s with hashcat on GPUs (2 billion vs ~5 million hashes/sec on a laptop), token theft via XSS + image-based exfiltration and tcpdump on HTTP, and RSA/HMAC confusion allowing forged tokens when keys/algorithms aren’t enforced. The demo app uses sessionStorage and Authorization headers; fixes shown include requiring specific algorithm+key, HTTPS, CSP, hardened cookies and the OWASP cookie+fingerprint pattern; revocation and timeouts remain developer responsibilities.
AI-written summary · about
chapters (8)
- 0:00Introduction to JWT security
- 5:27Problem with none algorithm
- 16:15HS256 key cracking demo
- 23:10Key length recommendations
- 25:19HTTP token sniffing demo
- 29:10HTTPS and XSS vulnerabilities
- 32:11Solutions and best practices
- 35:27Logout and token revocation
related talks
31mThe Hacker's Guide to JWT Security
43mThe Hacker's Guide to JWT Security
48mThe Hacker's Guide to JWT Security
47mThe Hacker's Guide to JWT Security
25mHandling JWTs: Understanding Common Pitfalls
54mAre you sure your access tokens are really secure?
22mAPI Authentication Deep Dive: OAuth 2.0, Tokens, and JWTs
43mDo You Really Know JWT?