JSON Web Tokens (JWT)
JSON Web Tokens (JWTs) are a compact, URL-safe format for transmitting signed claims between parties, defined in RFC 7519. They consist of three Base64-encoded parts — header, payload, and signature — and are most commonly used for stateless authentication and session management in modern web and API applications. Their flexibility is also their biggest source of bugs.
JWT vulnerabilities typically come from flawed validation rather than from the spec itself. Servers that accept the "alg": "none" header skip signature verification entirely. Servers that accept multiple algorithms can be tricked into algorithm confusion attacks — for example, treating an RSA public key as an HMAC secret. The "kid" header has been a recurring source of SQL injection, path traversal, and arbitrary file read. Weak HMAC secrets fall to brute force in minutes with tools like jwt_tool. And even libraries that get the basics right have repeatedly shipped regressions that re-enable old attacks years later.
Storage and lifecycle introduce a second class of risk: tokens kept in localStorage are XSS-readable, refresh-token rotation is often skipped, and revocation is rarely implemented because JWTs are designed to be stateless. RFC 8725 ("JWT Best Current Practices") exists specifically because the original spec left too much room for unsafe defaults.
This page collects PortSwigger's JWT research and Web Security Academy labs, the major open-source testing tools (jwt_tool, jwt-pwn, jwtXploiter, c-jwt-cracker), CVE writeups, OWASP cheat sheets, and bug bounty methodologies for attacking JWT-based authentication.
From OWASP JWT Cheat Sheet
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-15 2026 | Revisiting JWT Token Forgery Attack on Recent Bounty Target intermediate | This article discusses JWT (JSON Web Token) token forgery attacks, a common vulnerability in web portal authentication. The author explains that JWTs are signed by the server and used for subsequent requests. If the signature verification is flawed, attackers can manipulate the token's claims, effectively impersonating users or gaining unauthorized access. The content highlights the critical importance of robust signature verification in the JWT authentication process to prevent such exploits. → infosecwriteups.com |
| 2026-08-07 2026 | I made a full JWT hacking tutorial + testing suite intermediate 7 min read | Tool that decodes, edits, and forges JSON Web Tokens (JWTs), demonstrating attacks like `alg:none`, algorithm confusion, and `kid` injection. It provides a step-by-step walkthrough for each technique, explaining JWT structure and signature verification bypasses. The suite operates entirely client-side, ensuring tokens and secrets remain on the user's machine. |
| 2026-07-23 2026 | Two Ways To Mess Up Your JWT Safety Net In Your Own Lab. intermediate 7 min read AuthN | Library for implementing JSON Web Token (JWT) security in web applications. This resource details two common misconfigurations found in lab environments that can lead to JWT bypasses. The first vulnerability arises from client-side role checks, which are easily circumvented. The second, more critical flaw stems from using `jwt.decode()` instead of `jwt.verify()` on the server-side, allowing attackers to tamper with the JWT payload without invalidating the signature. The library emphasizes the importance of verifying JWT signatures to prevent unauthorized access to protected resources. → infosecwriteups.com |
| 2026-07-08 2026 | JWTweak v2.1: A Guided, Offline Toolkit for Modern JWT Attacks intermediate | Toolkit for offline JWT attack execution, JWTweak v2.1 guides users through identifying and exploiting vulnerabilities. Users paste JWTs to receive decoded and risk-scored tokens, suggested attack vectors, and step-by-step instructions for executing techniques such as algorithm confusion. This Python 3.8+ powered application requires pyjwt and cryptography libraries and operates entirely offline. → infosecwriteups.com |
| 2026-06-22 2026 | Top 3 security best practices for handling JWTs beginner 8 min read AuthN | Library for secure JWT handling that details three best practices: keeping tokens secret by using HTTPS and secure storage like HttpOnly/Secure cookies, validating tokens by checking signatures, expiration, issuer, and audience using libraries like PyJWT, and setting expiration times to limit token lifespan. The library also highlights how Snyk can identify vulnerabilities related to these practices, such as weak encryption or missing flags. → snyk.io |
| 2026-06-14 2026 | Can Snyk Detect JWT Security Issues? intermediate 4 min read | Library that analyzes Node.js applications for insecure JSON Web Token (JWT) usage, specifically identifying the misuse of `jsonwebtoken`'s `jwt.decode()` function, which can lead to broken authentication vulnerabilities. It also flags hardcoded secrets, insufficient logging, lack of rate limiting, and missing token expiration enforcement. → snyk.io |
| 2026-06-12 2026 | 3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs intermediate 10 min read AuthN | Library for detecting common OAuth abuse techniques including Device Code phishing and Resource Owner Password Credentials (ROPC) attacks. It highlights how attackers leverage these flows to bypass MFA and Conditional Access, and how to identify such activities by analyzing Entra ID sign-in logs. The library also details how to detect the subsequent attack stage of device registration using specific application-resource combinations. → wiz.io |
| 2026-06-08 2026 | Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass news 8 min read AuthN | Tool for detecting CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS, by anonymously querying the GlobalProtect portal's prelogin endpoint. The script identifies vulnerable instances by verifying Cloud Authentication Service (CAS) attachment and the PAN-OS version, differentiating it from management interface exploitation. This detection method aids defenders in prioritizing patching to fixed versions (10.2.18+, 11.1.15+, 11.2.12+, 12.1.7+) or implementing workarounds like detaching CAS from authentication profiles. → bishopfox.com |
| 2026-04-22 2026 | CVE-2026-32597: PyJWT Information Disclosure Vulnerability news 4 min read | Writeup of CVE-2026-32597, an information disclosure vulnerability in PyJWT versions prior to 2.12.0. The library fails to properly validate the RFC 7515 crit (Critical) Header Parameter, allowing attackers to bypass security controls by crafting tokens with unrecognized critical extensions that are silently ignored instead of rejected. This input validation error, classified under CWE-345, can lead to authentication bypass in applications relying solely on PyJWT for validation. Mitigation involves upgrading PyJWT to version 2.12.0 or later and implementing additional validation logic. → sentinelone.com |
| 2026-04-22 2026 | CVE-2026-34950 fast-jwt: Incomplete Fix for CVE-2023-48223 news 4 min read | Writeup of CVE-2026-34950 in fast-jwt, detailing an incomplete fix for CVE-2023-48223. This vulnerability arises from a regex anchor issue in `publicKeyPemMatcher`, allowing leading whitespace in PEM keys to cause the library to misclassify RSA public keys as HMAC secrets. An attacker can then forge HS256 tokens using the public key as the secret, bypassing authentication for applications using RS256 without algorithm specification. → endorlabs.com |
| 2026-04-22 2026 | CVE-2026-22817: JWT Algorithm Confusion in Hono news 1 min read | Writeup of CVE-2026-22817 in Hono, detailing an authentication bypass vulnerability allowing attackers to forge JSON Web Tokens (JWTs). The flaw, occurring in Hono versions prior to 4.11.4, exploits JWT algorithm confusion by enabling the use of asymmetric algorithms (like RS256) with symmetric verification, effectively allowing the server's public key to be treated as an HMAC secret for signature verification. Remediation involves updating Hono to version 4.11.4 and explicitly defining the `alg` parameter in JWT middleware configurations. |
| 2026-04-22 2026 | Proof of Concept for CVE-2026-29000 (pac4j-jwt) intermediate 1 min read | Tool for demonstrating CVE-2026-29000, a critical improper authentication vulnerability in pac4j-jwt affecting versions prior to 4.5.9, 5.7.9, and 6.3.3. The proof of concept script automates key discovery, forges an unsigned JWT with `alg: none`, wraps it in a JWE, and exploits the flaw to bypass signature verification, enabling authentication bypass and privilege escalation. Mitigation involves updating pac4j-jwt, enforcing valid signatures, and potentially disabling JWE. |
| 2026-04-22 2026 | CVE-2026-23993: JWT Authentication Bypass in HarbourJwt via Unknown alg news 4 min read | Writeup of CVE-2026-23993 details an authentication bypass vulnerability in HarbourJwt. The flaw occurs when an unrecognized JWT algorithm value in the header causes signature verification to be bypassed because the `GetSignature` method returns an empty string for unknown algorithms, leading to a successful string comparison during verification. This allows attackers to forge tokens with an empty signature, bypassing cryptographic checks. → pentesterlab.com |
| 2026-04-22 2026 | draft-ietf-oauth-rfc8725bis: JSON Web Token Best Current Practices beginner 30 min read | Reference document detailing JSON Web Token (JWT) Best Current Practices. This specification updates RFC 7519 and replaces RFC 8725, offering actionable guidance on secure JWT implementation and deployment. It covers threats and vulnerabilities like weak signatures, insufficient validation, weak symmetric keys, insecure encryption use, plaintext leakage, substitution attacks, and JWE decompression bomb attacks. The document also outlines best practices, including algorithm verification, appropriate algorithm selection, cryptographic input validation, sufficient key entropy, UTF-8 usage, and validation of issuer, subject, and audience claims. |
| 2026-04-19 2026 | CVE-2025-45768: PyJWT Information Disclosure Vulnerability news 4 min read | Library update detailing CVE-2025-45768, a weak encryption vulnerability in PyJWT v2.10.1. This flaw arises from the library's failure to enforce minimum key length requirements, potentially allowing attackers to forge JWT tokens and bypass authentication. While the vendor disputes the classification, applications using this version without strong key management practices are at risk. Mitigation involves implementing application-level key length validation, enforcing minimum key sizes (256 bits for HMAC, 2048 bits for RSA), and rotating potentially weak keys. → sentinelone.com |
| 2026-04-19 2026 | How JWT Libraries Block Algorithm Confusion: Code Review Lessons intermediate 11 min read | Library code review lessons demonstrate how JWT libraries block algorithm confusion attacks. Vulnerabilities arise when applications incorrectly verify tokens, allowing attackers to manipulate the `alg` header. Libraries like brianvoe/sjwt and Corviz/jwt mitigate this by supporting only HMAC. Others, such as garyf/json_web_token and nowakowskir/php-jwt, enforce algorithm matching between the header and the verification call. The auth0/java-jwt library employs a defense-in-depth approach, first verifying header-algorithm consistency and then relying on the developer-specified algorithm for verification. jpadilla/pyjwt detects improper use of public keys with HMAC algorithms. → pentesterlab.com |
| 2026-04-19 2026 | JSON Web Token Attacks and Vulnerabilities — Acunetix beginner 12 min read | Library provides a deep dive into JSON Web Token (JWT) attacks and vulnerabilities, detailing the structure of JWTs and common exploitation techniques like failing to verify signatures, allowing the "None" algorithm, and algorithm confusion. It explains how attackers can bypass signature verification through these flaws to gain unauthorized access or elevate privileges, emphasizing the critical need for proper implementation and validation of JWTs. → acunetix.com |
| 2026-04-19 2026 | Analyzing Broken User Authentication Threats to JWTs — Akamai intermediate | Analyzing Broken User Authentication Threats to JWTs — Akamai → akamai.com |
| 2026-04-17 2026 | JWT Token Lifecycle: Expiration, Refresh, and Revocation beginner 17 min read | Library for managing JSON Web Token (JWT) lifecycles, focusing on strategies for expiration, refresh, and revocation. It details short-lived vs. long-lived tokens, absolute vs. sliding expiration, and security configurations for Keycloak, while also referencing compliance requirements from NIST, PCI DSS, HIPAA, SOX, and GDPR to prevent vulnerabilities and ensure secure session management. |
| 2026-04-17 2026 | python-jwt token forgery CVE-2022-39227 news | Library for Python JWT token forgery (CVE-2022-39227) allows attackers to forge JWT contents without the secret key by exploiting an inconsistency between parsers in python-jwt and its jwcrypto dependency. This enables identity spoofing, session hijacking, and authentication bypass. Users should upgrade to version 3.3.4. |
| 2026-04-17 2026 | CVE-2024-53861: PyJWT Issuer Field Partial Match news 3 min read | Writeup of CVE-2024-53861 in PyJWT, detailing how a change in issuer claim validation from list to sequence checking in version 2.10.0 allows for partial string matches, such as accepting 'urn:' when 'urn:expected' is required. This vulnerability, affecting PyJWT versions 2.10.0, has a CVSS score of 2.2 and is fixed in version 2.10.1, posing a risk of unauthorized access if issuer validation is not robust. |
| 2026-04-17 2026 | Python-JOSE Security Risk: CVE-2024-33663 Explained news 3 min read | Writeup of CVE-2024-33663 detailing an algorithm confusion vulnerability in Python JOSE library versions up to 3.3.0. The issue arises from mishandling OpenSSH ECDSA keys, leading to cryptographic failures and potential compromise of data integrity and confidentiality. The writeup includes a proof of concept script demonstrating an exploit by using an inappropriate ECC key for HS256 signing, and recommends upgrading to Python JOSE 3.3.1+ and implementing strict input validation. |
| 2026-04-17 2026 | JWT Bomb in Python-JOSE CVE-2024-33664 news | JWT Bomb in Python-JOSE CVE-2024-33664 |
| 2026-04-17 2026 | JWT Pentest Book (six2dez) beginner | JWT Pentest Book (six2dez) |
| 2026-04-17 2026 | JWT Pentest Checklist (Cyber Frogy) beginner | Checklist detailing 27 common JSON Web Token (JWT) vulnerabilities. It offers penetration testers, developers, and security teams a structured approach to identify flaws, including testing steps, expected outcomes, and security recommendations for secure JWT implementations. |
| 2026-04-17 2026 | JWT Pentest Checklist v1.0 (Chintan Gurjar) beginner | JWT Pentest Checklist v1.0 (Chintan Gurjar) |
| 2026-04-17 2026 | HackerOne #1210502: Jitsi Authentication Bypass (JWT) intermediate | HackerOne #1210502: Jitsi Authentication Bypass (JWT) → hackerone.com |
| 2026-04-17 2026 | HackerOne #2472798: Newspack Extended Access JWT bypass intermediate | HackerOne #2472798: Newspack Extended Access JWT bypass → hackerone.com |
| 2026-04-17 2026 | JSON Web Token Vulnerabilities (0xn3va cheat sheet) beginner | JSON Web Token Vulnerabilities (0xn3va cheat sheet) → 0xn3va.gitbook.io |
| 2026-04-17 2026 | JWT Forgery via unvalidated jku parameter (Invicti) intermediate | Library for detecting JWT forgery via unvalidated `jku` parameters, a vulnerability identified by Invicti. This flaw allows attackers to tamper with JWT payloads, leading to privilege escalation, user impersonation, or unintended application states. It can also facilitate blind SSRF attacks. Mitigation involves whitelisting allowed JWK URLs and disabling HTTP redirection for token retrieval. → invicti.com |
| 2026-04-17 2026 | jwt-hack: JSON Web Token Hack Toolkit (GitHub) intermediate 3 min read | Library for testing, analyzing, and attacking JSON Web Tokens. It supports decoding regular and DEFLATE-compressed JWTs, encoding JWE tokens, verifying signatures with secrets or keys, and performing dictionary and brute-force attacks. The library can also scan for common vulnerabilities like the 'none' algorithm, weak secrets, algorithm confusion, and JKU/X5U header attacks. It offers a REST API for automation and can function as an MCP server for AI model integration. |
| 2026-04-17 2026 | Insecure JSON Web Tokens (The Hacker Recipes) beginner 4 min read | Library detailing insecure JSON Web Token (JWT) implementations, covering techniques like signature attacks using the "None" algorithm or switching RS256 to HS256 with an obtained public key. It also explores KID header path traversal vulnerabilities, cracking secrets with `jwt_tool.py` and `hashcat`, and recovering public keys using `JWT-Key-Recover`. |
| 2026-04-17 2026 | Hacking JSON Web Tokens - Vickie Li beginner | Hacking JSON Web Tokens - Vickie Li |
| 2026-04-17 2026 | Known Exploits and Attacks (jwt_tool Wiki) intermediate 4 min read | Library of known JWT exploits and attacks, including CVE-2015-9235 (alg:none), CVE-2016-5431 (Key Confusion), CVE-2018-0114 (Key Injection), and CVE-2020-28042 (Null Signature). This resource also details JWKS Spoofing, "kid" Injection, cross-service relay attacks, weak secret cracking, and key injection via inline public keys. Each attack type is explained with examples and mitigation strategies for JWT configurations. |
| 2026-04-17 2026 | JWT Security Best Practices for 2025 (JWT.app) beginner 5 min read | Library detailing JWT security best practices for 2025, covering cryptographically strong secret management, optimal token expiration strategies, comprehensive validation including checking revocation lists and user status, secure storage methods like HTTP-Only cookies, algorithm considerations (EdDSA, ES256, RS256, PS256), token refresh mechanisms, and protection against common attacks such as algorithm confusion and token sidejacking, alongside monitoring and auditing. |
| 2026-04-17 2026 | JWT Security Best Practices (Phase Two) beginner 9 min read | Library detailing secure JSON Web Token (JWT) implementation, covering payload transparency, TLS transmission, proper CORS policies, and information leakage prevention. It discusses algorithm selection between symmetric (HMAC) and asymmetric (RSA/ECC) signatures, emphasizes essential claims like `iss`, `aud`, `exp`, and `jti`, and outlines token revocation strategies such as short token lifetimes and the refresh token pattern with distributed blacklisting. |
| 2026-04-17 2026 | JWT Security Guide: Best Practices & Implementation (Gupta Deepak) beginner 5 min read | Library exploring JSON Web Tokens (JWTs) details their evolution from traditional session management, structure including header, payload, and signature, and practical workflow. It highlights common vulnerabilities like signature verification flaws, algorithm confusion attacks (including the "none" algorithm), client-side storage risks, and the revocation challenge. Essential security practices covered include secure communication via HTTPS, smart token storage using HttpOnly cookies, token lifecycle management with expiration, refresh tokens, and blacklisting, and payload security. Advanced measures like fingerprinting and audience validation are also discussed. |
| 2026-04-17 2026 | JWT authentication bypass via kid header path traversal (siunam) intermediate 2 min read | Writeup detailing a JWT authentication bypass exploiting a `kid` header path traversal vulnerability. This technique allows an attacker to manipulate the `kid` parameter to point to a server filesystem file, such as `/dev/null`, and then sign the JWT with a secret matching the file's content, like a null byte encoded as `AA==`. The bypassed authentication can then be used to gain administrator privileges and perform unauthorized actions, such as deleting users. |
| 2026-04-17 2026 | JWT authentication bypass via algorithm confusion (siunam) intermediate 3 min read | Library for demonstrating JWT algorithm confusion attacks. This resource details how to exploit vulnerabilities where an application uses an asymmetric signing algorithm like RS256 but can be tricked into using a symmetric one like HS256 with the public key as the shared secret. It walks through obtaining the server's public key, formatting it, modifying the JWT header to HS256, altering the payload to gain administrator privileges, and signing the token using the public key as the secret to bypass authentication. |
| 2026-04-17 2026 | ctf-jwt-token: Vulnerability in early JWT node.js library (GitHub) intermediate 2 min read | Library demonstrating a vulnerability in an early JWT node.js library. The example showcases how an attacker can modify a JWT token, exploiting the "none" algorithm support in older `jsonwebtoken` versions (like v0.4.0) to elevate their privileges from a common user to an admin, thereby accessing restricted content. The resource includes the source code, Docker image, and a Python script for performing the attack. |
| 2026-04-17 2026 | JWT Authentication Bypass Using alg:none - CTF Writeup intermediate | JWT Authentication Bypass Using alg:none - CTF Writeup |
| 2026-04-17 2026 | JWT Algorithm Confusion Attack: Two Active CVEs in 2026 news 6 min read | Reference detailing CVE-2026-22817 affecting Hono and CVE-2026-23993 impacting HarbourJwt, both stemming from JWT libraries that trust the token's `alg` header for signature verification. The article explains how attackers can exploit this, including an RS256-to-HS256 swap in Hono and an unknown algorithm bypass in HarbourJwt, and provides methods for detection and prevention such as algorithm pinning and validating `iss`/`aud` claims. |
| 2026-04-17 2026 | JWT Algorithm Confusion: Turning RS256 Tokens into HS256 Disasters intermediate | JWT Algorithm Confusion: Turning RS256 Tokens into HS256 Disasters |
| 2026-04-17 2026 | Understanding JWT Security and Common Vulnerabilities (secops) beginner 8 min read | Library detailing common JSON Web Token (JWT) vulnerabilities, including the "None" algorithm bypass, key injections via the `kid` parameter, and algorithm confusion attacks where RS256 can be downgraded to HS256. It explains how to test for these by verifying signature integrity, altering claims, bypassing signature checks, and hunting for exposed signing keys, referencing CVE-2022-21449. The resource also provides a walkthrough of the Certified API Pentester Mock Exam to demonstrate real-world exploitation scenarios. |
| 2026-04-17 2026 | JWT Vulnerabilities List: 2026 Security Risks & Mitigation Guide (Red Sentry) beginner 3 min read | Guide on 2026 JWT vulnerabilities, detailing risks like failing signature verification, none algorithm exploitation, and algorithm confusion. It addresses specific CVEs from 2025, including CVE-2025-4692 and CVE-2025-30144, and their impact on sectors like B2B SaaS, healthcare, and FinTech. Mitigation strategies focus on key management, validation of claims (iss, aud, exp), and incorporating OWASP testing into pentests, referencing work by Vaadata, Invicti, and PortSwigger. |
| 2026-04-16 2026 | JWT Header Parameter Injections intermediate | JWT Header Parameter Injections |
| 2026-04-16 2026 | CVE-2026-29000: Authentication Bypass in pac4j-jwt news | Writeup of CVE-2026-29000, an authentication bypass in pac4j-jwt. A remote attacker with the server's RSA public key can exploit a logic error in JwtAuthenticator's handling of JWEs containing unsigned PlainJWTs. This flaw allows unverified claims to grant impersonation privileges, including administrator access. Deployments using RSA JWE with both EncryptionConfiguration and SignatureConfiguration in JwtAuthenticator are vulnerable. A public proof-of-concept is available. → arcticwolf.com |
| 2026-04-16 2026 | JWT Algorithm Confusion Attacks: CVE-2026-22817 Fix Guide intermediate 6 min read | Guide addressing JWT algorithm confusion attacks, detailing how vulnerable libraries trust attacker-controlled `alg` fields in JWT headers. It explains the exploitation of CVE-2026-22817, CVE-2026-27804, and CVE-2026-23552, impacting frameworks like Hono, Parse Server, HarbourJwt, and Apache Camel. The guide provides specific fixes, including upgrading to patched versions and explicitly pinning allowed algorithms like RS256, rather than inferring them from the token, to prevent token forgery and bypasses. |
| 2026-04-11 2026 | CVE-2024-33663: Python-jose Algorithm Confusion news 4 min read | Writeup on CVE-2024-33663, an algorithm confusion vulnerability impacting python-jose through version 3.3.0. This flaw allows attackers to exploit key format confusion with OpenSSH ECDSA keys, potentially enabling authentication bypass or signature forgery. The vulnerability, similar to CVE-2022-29217 affecting PyJWT, arises from improper algorithm enforcement during JWT verification, allowing attackers to craft malicious tokens by using a public key as a symmetric secret. Mitigation involves explicit algorithm allowlisting and upgrading affected python-jose versions. → sentinelone.com |
| 2026-04-11 2026 | Severe Security Flaw Found in jsonwebtoken Library news 2 min read | Writeup of CVE-2022-23529 in the jsonwebtoken library, a vulnerability that could lead to remote code execution when verifying a maliciously crafted JSON web token. The flaw, which impacts versions prior to 9.0.0, requires an attacker to exploit a separate flaw in the secret management process for exploitation. While the CVE was initially high-severity, it has since been retracted as the risk is primarily in insecure calling code rather than the library itself. → thehackernews.com |
| Browse all 108 JSON Web Tokens (JWT) resources → | ||
Frequently Asked Questions
- What is JWT algorithm confusion?
- Algorithm confusion (also called key confusion) exploits servers that accept multiple JWT signing algorithms. The classic example: a server expects an RS256 (asymmetric) signature but accepts HS256 (symmetric). An attacker switches the alg header to HS256 and signs the token using the server's RSA public key as the HMAC secret — turning a verification key into a signing key.
- What is the JWT "none" algorithm vulnerability?
- The JWT specification allows an alg value of "none", meaning the token is unsigned. Some libraries historically accepted this even for tokens that should have been verified, letting an attacker forge any payload. Modern libraries reject "none" by default, but the bug periodically resurfaces in custom implementations and lesser-used languages.
- Should I store JWTs in localStorage or cookies?
- Both have tradeoffs. localStorage is vulnerable to XSS — any script on the page can read the token. Cookies with HttpOnly, Secure, and SameSite=Strict prevent XSS theft but introduce CSRF risk if not handled. For most applications, HttpOnly cookies with proper CSRF defenses are the safer choice. Refresh-token rotation and short JWT lifetimes reduce the impact either way.
Weekly AppSec Digest
Get new resources delivered every Monday.