JWT: Mastering Security for Stateless Tokens
summary
The talk explains how to harden JSON Web Tokens (JWTs) for secure, stateless authentication when implementing FranceConnect+ and eIDAS-compliant integrations. It covers specific threats—signature-algorithm attacks, sensitive data leakage in JWT payloads, and token theft—and gives concrete ANSSI-based recommendations and best practices to strengthen JWT handling in OpenID/IAM scenarios.
AI-written summary · about
chapters (10)
- 0:00JWT authentication basics
- 1:47OpenID with FranceConnect Plus
- 3:50JWT token structure flaws
- 5:55Issuer and audience checks
- 7:41JWT encryption risks
- 10:10Securing JWT best practices
- 11:12Signed token payload analysis
- 12:16Token timing validation
- 13:18Nonce verification
- 14:22Access token revocation
related talks
23mLet's talk about JWT
38mAuthentication as a Microservice: Portable Customer Identity Management
37mJWT - To authentication & beyond!
15mJWTs And Why They Suck
32mTips and Tricks for JSON Web Tokens (JWTs)
43mDo You Really Know JWT?
35mAttacks on JSON Web Tokens: A Comprehensive Analysis
25mHandling JWTs: Understanding Common Pitfalls