The newest JSON Web Tokens (JWT) resources are on the JSON Web Tokens (JWT) page. For a reading order instead of a date order, see the JSON Web Tokens (JWT) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-04-02 2023 | JWT [JSON WEB TOKENS] [EXPLANATION & EXPLOITATION] (0x02) intermediate | JWT [JSON WEB TOKENS] [EXPLANATION & EXPLOITATION] (0x02) https://ift.tt/Pk0dAUM |
| 2021-11-03 2021 | Introducing CookieMonster: a tool for breaking stateless authentication intermediate 4 min read AuthN | Tool that detects broken stateless authentication, such as insecure JWTs or framework-specific session cookies from Django, Flask, and Laravel. CookieMonster, written in Go for high performance, can decode and unsign cookies, and even resign them with modified content. It supports automated scanning pipelines and manual testing, offering real-time alerting for thousands of requests per second, significantly improving on the limitations of earlier tools like Flask-Unsign. |
| 2021-10-14 2021 | These are the security issues with JWT beginner 4 min read AuthN | Reference detailing security issues with JWTs, highlighting the impossibility of revocation and the need for custom solutions for logouts or permission adjustments. It discusses storage vulnerabilities like XSS and CSRF, referencing OWASP's recommendations for hardened cookies and their implications. The article emphasizes JWT suitability for stateless applications, as per the OWASP JWT Cheat Sheet, and contrasts them with traditional session tokens. |
| 2021-09-13 2021 | The Wonderful World of Tokens and Claims: CWT beginner AuthN | The Wonderful World of Tokens and Claims: CWT |
| 2021-07-19 2021 | Where to Store the JSON Web Token (JWT)? intermediate AuthN | This content explores secure storage options for JSON Web Tokens (JWTs) in web applications. It highlights the trade-offs between client-side (e.g., browser local storage, session storage, cookies) and server-side storage. Key considerations include vulnerability to Cross-Site Scripting (XSS) attacks for client-side storage and potential for token hijacking. The article likely delves into best practices and recommended approaches to mitigate these risks and maintain the security of JWTs. |