{JWT}.{Misuse}.&Abuse
summary
Shows concrete failures: a missing signature verification lets a forged ID token grant admin access; substituting a code token for an access token works even when tokens are signed and encrypted. Demonstrations use Burp Suite Pro and a JWT editor against a Dockerized training app (OwnedHub) with live replayed POSTs and modified claims. Recommends always verify signatures, check aud and bind expected claims, encrypt sensitive tokens, and prefer magic links for passwordless flows.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 7:45What are JWTs and claims
- 15:53Why JWTs matter and their flaws
- 22:33JWTs in authentication
- 33:15JWTs in authorization
- 42:30JWTs in information exchange
- 55:13Responsible JWT usage
- 58:21Conclusion and resources
related talks
35mAttacks on JSON Web Tokens: A Comprehensive Analysis
47mThe Hacker's Guide to JWT Security
31mThe Hacker's Guide to JWT Security
54mAre you sure your access tokens are really secure?
48mThe Hacker's Guide to JWT Security
43mThe Hacker's Guide to JWT Security
37mAttacking and Defending JWT Tokens: The Ultimate Guide
37mThe Hacker's Guide to JWT Security