Attacks on JSON Web Tokens: A Comprehensive Analysis
summary
Explains concrete JWT failings and exploits: tampering a token when signature checks are disabled (example .NET flag RequireSignedTokens = false), forging tokens from a rogue issuer when ValidateIssuer = false, replaying expired tokens when ValidateLifetime = false, and abusing missing audience checks to access other services. Demonstrations use Burp Suite to capture and modify bearer tokens and JWT.io for inspection; source shows single-line misconfigurations; fixes are enabling validations, short expiries, revocation, and using vetted SDKs.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker intro
- 2:36About the speaker and team
- 10:39What are JSON Web Tokens
- 18:26How JWT signature validation works
- 23:18Signature validation bypass attacks
- 25:46Issuer validation bypass explained
- 27:51Expiry validation bypass risks
- 30:47Audience validation bypass flaws
- 33:58Summary and key takeaways
