Handling JWTs: Understanding Common Pitfalls
summary
Explains the exact failure modes: the RFC-allowed none algorithm can make receivers accept unsigned tokens, symmetric secrets can be brute-forced (demoed with shotcrack and a MacBook cracking a short key in ~10 seconds), and attackers target stored tokens. Recommends forbidding algorithms except RS256, using long secrets and hardware-backed key stores like AWS KMS or Vault, setting Secure, HTTPOnly cookie and SameSite flags or keeping tokens in memory, and keeping expirations short because revocation for stateless JWTs is hard.
AI-written summary · about
chapters (13)
- 0:00JWTs and their purpose
- 2:30JWT validation analogy
- 4:37JWT structure breakdown
- 7:03JWT signing methods
- 9:31Symmetric vs asymmetric signing
- 13:23Microservice JWT workflow
- 15:12Danger of none algorithm
- 17:40Brute-forcing symmetric keys
- 19:27Why attackers target JWTs
- 20:09JWT storage in cookies
- 21:34Securing signing keys with HSMs
- 22:36JWTs vs session tokens
- 24:02JWT revocation challenges
