The Hacker's Guide to JWT Security
summary
Demos show concrete failures: a library accepting "alg":"none" lets an attacker swap tokens and gain sessions, and poor APIs like parse vs parseClaimsJws cause silent acceptance of unsigned tokens. HS256 secrets are brute forced offline (Hashcat on GPUs reaches billions hashes/sec; a 6‑char secret is trivial; use ≥32‑byte keys). Packet sniffing and XSS demo exfiltrates sessionStorage tokens; mitigation options include cookies with HttpOnly plus fingerprinting (cookie vs token claim), short expirations, revocation state, and RSA ≥2kbit keys.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:15About Me
- 2:00RFC 7519, JSON Web Token
- 10:15io.jsonwebtoken
- 13:04Another Library with None Problem
- 13:49Library API Problem
- 15:03Why to Require Algorithm and Key?
- 23:06hashcat
- 23:26Demo #2, Problems
- 24:10JWT, Algorithms
- 25:05JWT, HS Family
- 37:28XSS Attack Vector
- 38:36Problems and Solutions
- 42:23OWASP Token Sidejacking Solution
- 44:19Basic Hygiene: Timeouts and Logouts
- 47:34Continuous Learning
related talks
47mThe Hacker's Guide to JWT Security
31mThe Hacker's Guide to JWT Security
37mThe Hacker's Guide to JWT Security
43mThe Hacker's Guide to JWT Security
25mHandling JWTs: Understanding Common Pitfalls
37mAttacking and Defending JWT Tokens: The Ultimate Guide
54mAre you sure your access tokens are really secure?
34mWhat makes JSON Web Tokens (JWT) secure?