Beyond Base64: The Anatomy of a JWT, Signature Forgery, and Common Security Blunders
JSON Web Tokens (JWTs) have become the default mechanism for stateless authentication and authorization across modern microservices, SPAs, and mobile applications. Defined formally in RFC 7519, JWTs o
Responses
Markdown supported · ⌘↵ to post
StackShortlist
Proof Over Promises.
The alg none and RS256 to HS256 confusion attacks are still the best argument for pinning the expected algorithm on the verifier instead of trusting the header. It is also worth checking aud and iss on every service, since a token issued for one internal API being accepted by another is a quieter but common mistake. Short lived access tokens plus a revocable refresh token cover most of the logout problem that stateless tokens create.