Do You Really Know JWT?
summary
Covers JSON Web Tokens (JWT): explains token structure and formats (JWS, JWE, JWK) and key transport, then demonstrates practical attacks using a custom PHP verifier and unit tests — including alg=none exploitation, RSA-to-HMAC key confusion, brute-forcing weak secrets, and ciphertext malleability that flips claims. Uses jwt.io and a homemade library to reproduce failures and finds libraries/defaults that accept insecure headers; recommends long secrets or asymmetric keys, algorithm allowlists, validate iss/aud/exp, short lifetimes, key rotation, and using well-tested libraries.
AI-written summary · about
chapters (16)
- 0:00Start
- 9:36Focus on the payload
- 15:50Key management
- 20:52And the attacks?
- 30:33Modifying encrypted data
- 31:29Substitution
- 31:59The JWT paradox
- 33:44Some security tips
- 35:08Validating claims
- 35:40Prefer asymmetric
- 36:00Use an existing and proven library
- 36:42Don't fight to revoke JWTs
- 37:27About privacy
- 37:58Avoid logging tokens
- 38:23Include necessary and sufficient information
- 39:10What are the alternatives?
