Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

JWT

A JSON Web Token is only as trustworthy as the check that verifies it. Here is how alg:none, algorithm confusion, weak secrets and injected key headers turn a signed token into one anyone can mint, and how to pin verification down.

1 article 8 min total Overview to advanced techniques

Start with the overview

JWT8 min read

JWT Attacks, Explained: When a Token Decides How to Verify Itself

A JSON Web Token is only as trustworthy as the check that verifies it. Here is how alg:none, algorithm confusion, weak secrets and injected key headers turn a signed token into one anyone can mint, and how to pin verification down.

Read the overview