What makes JSON Web Tokens (JWT) secure?
summary
Explains JWT as header payload signature, shows signing with HMAC SHA256 and recommends a 256‑bit secret, compares HS256 RS256 and ES256 and measures tradeoffs, demonstrates concrete attacks (alg none signature‑stripping RS/HS confusion substitution when reusing secrets XSS and token theft), and gives fixes: whitelist algorithms, include audience claim, use different secrets per service, short-lived tokens with silent refresh, avoid persistent localStorage, and use vetted libraries and the jwt.io debugger to test implementations.
AI-written summary · about
chapters (4)
- 0:00Start
- 12:50none no signature
- 13:01HS256: HMAC + SHA-256 relies on a shared secret
- 13:19RS256: RSASSA + SHA-256 relies on a private public RSA key pair
