Attacking and Defending JWT Tokens: The Ultimate Guide
summary
Explains JWT structure (header.payload.signature), shows a real samokat.ru case where a predictable HMAC secret "secret" lets an attacker resign tokens and achieve full account takeover, and demonstrates a simple Python script that flips an admin claim and re-signs a token. Covers common failures: alg confusion / "none" attacks, jku/x5u leading to SSRF, missing claim validation, and gives concrete fixes: whitelist JWKS URLs, validate alg and claims, rotate keys, use KMS and monitor.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:06Historical context
- 2:00JWT fundamentals
- 4:24Token architecture
- 8:26Signature significance
- 17:35Terminology and standards
- 23:42Industry statistics
- 25:42Exploitation scenario
- 27:36Attack vectors
- 33:03Defensive strategies
- 35:04Q&A session
