JWT Security Testing

Overview

JWTs are used for authentication and authorization. Weak implementations can lead to authentication bypass.

JWT Structure

header.payload.signature

# Example:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4ifQ.
Gfx6VO9tcxwk6xqx9yYzSfebfeakZp5JYIgP_edcw_A

Attacks

1. Algorithm Confusion (Critical)

Change algorithm from RS256 to HS256, use public key as secret.