Posts tagged: #jwt

How to inspect JWT problems safely in logs, support tickets, CLI tools, screenshots, and incident channels without spreading bearer tokens.

Operational guidance for JWT signing keys: generation, storage, KMS use, rotation, access control, audit trails, and emergency response.

A field-tested sequence for testing JWT implementations, from collection and decoding to claims, keys, replay, and reporting.

Design notes for limiting replay when bearer tokens leak, including jti, session state, device signals, rotation, and proof of possession.

How to decide which claims can be trusted, which must be rechecked, and where JWTs should stop carrying authority.

A practical look at JWT storage in browsers, XSS, CSRF, cookies, localStorage, service workers, and threat model tradeoffs.

How exp, nbf, iat, skew windows, retries, and regional clocks affect real JWT validation decisions.

The messy edge cases behind JWKS caching, signing key rotation, stale kid values, and outage resistant verifier design.

How algorithm confusion appears when verifiers mix symmetric and asymmetric assumptions, with concrete testing and mitigation notes.

Why the old alg none bug still matters, how it appears in modern services, and how to test for it without theater.