Are you sure your access tokens are really secure?
summary
An API that used JWTs and a standard validation library accepts forged tokens because validators miss algorithm none bypass when casing varies and because headers can carry an attacker supplied JWK (self‑contained JWK in header) or JKU/X5C pointers that validation code blindly fetches. Demonstrations include a reproduced exploit against a Java validator, a .NET test suite and a Jotguard template that generates attacks and regression tests, and an algorithm confusion attack mixing HS256 and RS256 to gain admin access.
AI-written summary · about
chapters (9)
- 0:00Access token security intro
- 4:19JSON Web Token (JWT) basics
- 9:34Real-world token breach
- 17:44Secure JWT libraries
- 21:13Testing JWT security
- 28:15Breaking JWT validation
- 32:57Algorithm confusion attacks
- 49:52Security recommendations
- 50:24Q&A
