Known JWT Attacks

JWTs have a checkered history of attacks. Defensive checklist:

1. alg: none attack The none algorithm means "no signature". Some libraries accept tokens with alg: none and skip verification.

Defense: pin expected alg to a non-none value per key. Never trust the header's alg.

2. Key confusion (RS256 → HS256) If a verifier accepts both RS256 and HS256, an attacker can use the public key (which is public!) as the HMAC secret and sign a HS256 token.

Defense: pin the algorithm AND key type.

3. Weak HS256 secrets "secret", "password", "your-256-bit-secret" — JWTs with weak HMAC keys are crackable offline (john the ripper has a JWT mode).

Defense: use a CSPRNG for keys, 32+ bytes random.

4. JWT in URL Putting JWTs in the URL (?token=...) leaks them via referrer headers, logs, browser history.

Defense: Authorization header, secure cookies.

5. Long-lived tokens A stolen JWT with exp=1y is valid for a year. No revocation in vanilla JWT.

Defenses: short exp (15 min), refresh tokens (with revocation), JTI blacklist for critical revocations.

6. Sensitive data in payload Anyone can base64-decode the payload. Don't put PII or secrets there.

Defense: only put what's needed for authorization. Use opaque session IDs for sensitive data.