↓Skip to main content

JWT Attacks and Prevention

·1 min

Auth0 has a great write-up on common JWT attacks that is worth a look for anyone using JWT’s for authorization. I’ve provided a summary here as a TL;DR.

JWT Headers #

  • Do not process a JWT body before checking the header.
  • Ensure the header contains the correct alg and not alg: none.
  • If you are using HS256, consider switching to RS256 to avoid brute force attacks.

Encryption #

  • If you are using Elliptic-curve cryptography, ensure your implementation verifies that public-keys are a valid elliptic-curve point for the chosen curve and that private keys sit inside the valid range of values.

Body #

  • Check all provided claims: exp, iat, aud, sub, nbf before trusting the key.

There were just the most interesting take-aways. I highly suggest folks read the entire article.