JWT Vulnerabilities

Also Known As

TL;DR

Explanation

Common JWT vulnerabilities include: accepting the 'none' algorithm (no signature required), algorithm confusion attacks (RS256 public key used as HS256 secret), weak secrets susceptible to offline brute-force, missing expiry validation, and insecure storage of tokens in localStorage. Always validate the algorithm explicitly, reject 'none', use strong secrets or asymmetric keys, verify exp/nbf claims, and store tokens in HttpOnly cookies rather than JavaScript-accessible storage.

How It's Exploited

Diagram

flowchart TD
    subgraph alg none attack
        J1[Header: alg=none] --> J2[Signature stripped]
        J2 --> J3[Server accepts<br/>unsigned token!]
    end
    subgraph Algorithm confusion
        J4[RS256 token] --> J5[Attacker changes<br/>alg=HS256]
        J5 --> J6[Signs with<br/>public key as HMAC secret]
        J6 --> J7[Server verifies<br/>with same public key]
    end
    subgraph Fix
        F1[Whitelist allowed algorithms<br/>never accept none<br/>validate exp, iss, aud]
    end
    style J3 fill:#f85149,color:#fff
    style J7 fill:#f85149,color:#fff
    style F1 fill:#238636,color:#fff

Watch Out

Common Misconception

Why It Matters

Common Mistakes

• Not explicitly specifying the allowed algorithm when verifying — accepting whatever alg the token declares.
• Using a short or guessable HMAC secret — HS256 with a weak secret is crackable offline.
• Not validating exp, nbf, and iss claims after signature verification.
• Storing sensitive data in the payload without encrypting it — the payload is only base64-encoded, not secret.

Code Examples

// Trusting the algorithm from the token header:
$decoded = JWT::decode($token, $secret); // No algorithm allowlist specified
// Attacker sends alg=none token — some libraries accept it

// Whitelist algorithm — reject none and algorithm confusion:
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

// Always specify algorithm explicitly:
$decoded = JWT::decode(
    $token,
    new Key($publicKey, 'RS256') // Only RS256 accepted — rejects HS256, none
);

// Validate all critical claims:
if ($decoded->iss !== 'https://auth.example.com') {
    throw new Exception('Invalid issuer');
}
if ($decoded->aud !== 'api.example.com') {
    throw new Exception('Invalid audience');
}
if ($decoded->exp < time()) {
    throw new Exception('Token expired');
}

References

• ↗ https://portswigger.net/web-security/jwt
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html

Tags

Related Terms