Search
Search the blog.
Debugging JWTs without leaking secrets
How to inspect JWT problems safely in logs, support tickets, CLI tools, screenshots, and incident channels without spreading bearer tokens.
Signing key management for JWTs
Operational guidance for JWT signing keys: generation, storage, KMS use, rotation, access control, audit trails, and emergency response.
A practical JWT pentest workflow
A field-tested sequence for testing JWT implementations, from collection and decoding to claims, keys, replay, and reporting.
Replay resistant JWT sessions
Design notes for limiting replay when bearer tokens leak, including jti, session state, device signals, rotation, and proof of possession.
JWT claims and authorization boundaries
How to decide which claims can be trusted, which must be rechecked, and where JWTs should stop carrying authority.
Browser token storage reality
A practical look at JWT storage in browsers, XSS, CSRF, cookies, localStorage, service workers, and threat model tradeoffs.
JWT expiration and clock skew in production
How exp, nbf, iat, skew windows, retries, and regional clocks affect real JWT validation decisions.
JWKS cache and rotation failures
The messy edge cases behind JWKS caching, signing key rotation, stale kid values, and outage resistant verifier design.
HS256 and RS256 confusion attacks in real systems
How algorithm confusion appears when verifiers mix symmetric and asymmetric assumptions, with concrete testing and mitigation notes.
JWT alg none production lessons
Why the old alg none bug still matters, how it appears in modern services, and how to test for it without theater.