JWT Security Audit

JSON Web Tokens (JWT) are widely used for authentication but frequently misconfigured. Our scanner checks for weak signing algorithms (none, HS256 with weak keys), token expiration settings, sensitive data in payloads, and algorithm confusion vulnerabilities.

What This Scanner Does

Intercepts JWTs from cookies and headers, analyzes the header for algorithm choice, checks payload for sensitive data exposure, verifies expiration claims, and tests for algorithm confusion (RS256→HS256) and none-algorithm bypass.

Why It Matters

A weak JWT implementation can let attackers forge tokens and impersonate any user. The "none" algorithm bypass and algorithm confusion attacks have compromised countless applications. Sensitive data in JWT payloads is visible to anyone who base64-decodes the token.

Common Findings

• JWT using weak HS256 with guessable secret
• No expiration claim (exp) set on tokens
• Sensitive user data in JWT payload
• Algorithm confusion vulnerability (RS→HS)

OWASP Top 10 Coverage

Related Security Checks