JWT Attacks Explained (and How to Defend)

JSON Web Tokens (JWTs) carry identity claims signed by the server. They're convenient - and easy to implement insecurely.

The classic attacks

alg: none - the token header says "no signature." If the server trusts it, an attacker forges any claims (e.g. admin: true) with no key at all.
Weak HMAC secret - if the token is signed with HS256 and a guessable secret, an attacker cracks it offline (hashcat) and mints valid tokens.
Algorithm confusion (RS256 -> HS256) - the server verifies with the public key, but the attacker signs an HS256 token using that public key as the HMAC secret. If the library doesn't pin the algorithm, it verifies.
Missing validation - not checking expiry (exp), audience (aud) or issuer (iss), so old or cross-service tokens are accepted.

Pin the algorithm server-side - never trust the token's own alg header; reject none.
Strong secrets / proper keys - long random HS256 secrets, or RS256/ES256 with correct key handling.
Validate every claim - signature, exp, nbf, aud, iss.
Keep tokens short-lived and support revocation for sensitive apps.

Test your tokens with a tool like jwt_tool before an attacker does.

JSON Web Tokens (JWTs) carry identity claims signed by the server. They're convenient - and easy to implement insecurely.

alg: none - the token header says "no signature." If the server trusts it, an attacker forges any claims (e.g. admin: true) with no key at all.
Weak HMAC secret - if the token is signed with HS256 and a guessable secret, an attacker cracks it offline (hashcat) and mints valid tokens.
Algorithm confusion (RS256 -> HS256) - the server verifies with the public key, but the attacker signs an HS256 token using that public key as the HMAC secret. If the library doesn't pin the algorithm, it verifies.
Missing validation - not checking expiry (exp), audience (aud) or issuer (iss), so old or cross-service tokens are accepted.

Pin the algorithm server-side - never trust the token's own alg header; reject none.
Strong secrets / proper keys - long random HS256 secrets, or RS256/ES256 with correct key handling.
Validate every claim - signature, exp, nbf, aud, iss.
Keep tokens short-lived and support revocation for sensitive apps.

Test your tokens with a tool like jwt_tool before an attacker does.