JSON Web Tokens (JWT) Resources

JSON Web Tokens (JWT)

JSON Web Tokens (JWTs) are a compact, URL-safe format for transmitting signed claims between parties, defined in RFC 7519. They consist of three Base64-encoded parts — header, payload, and signature — and are most commonly used for stateless authentication and session management in modern web and API applications. Their flexibility is also their biggest source of bugs.

JWT vulnerabilities typically come from flawed validation rather than from the spec itself. Servers that accept the "alg": "none" header skip signature verification entirely. Servers that accept multiple algorithms can be tricked into algorithm confusion attacks — for example, treating an RSA public key as an HMAC secret. The "kid" header has been a recurring source of SQL injection, path traversal, and arbitrary file read. Weak HMAC secrets fall to brute force in minutes with tools like jwt_tool. And even libraries that get the basics right have repeatedly shipped regressions that re-enable old attacks years later.

Storage and lifecycle introduce a second class of risk: tokens kept in localStorage are XSS-readable, refresh-token rotation is often skipped, and revocation is rarely implemented because JWTs are designed to be stateless. RFC 8725 ("JWT Best Current Practices") exists specifically because the original spec left too much room for unsafe defaults.

This page collects PortSwigger's JWT research and Web Security Academy labs, the major open-source testing tools (jwt_tool, jwt-pwn, jwtXploiter, c-jwt-cracker), CVE writeups, OWASP cheat sheets, and bug bounty methodologies for attacking JWT-based authentication.

From OWASP JWT Cheat Sheet