jwt-attack-surface

What problem does it solve?

JWT-based authentication is common but often misconfigured, leading to vulnerabilities such as algorithm confusion, weak secrets, missing expiration/claims validation, and insecure token handling.

Core Features & Use Cases

• Algorithm Confusion vulnerabilities and misconfigurations (e.g., accepting multiple algorithms or 'alg=none').
• Weak Secrets and the need for cryptographically strong, long secrets.
• Missing Validation of exp, iss, aud, and signature checks.
• Token Handling best practices for storage, transmission, and revocation across services.
• Use Case security review of microservices and APIs relying on JWTs to verify integrity and authenticity.

Quick Start

Provide a JWT security review of your authentication flow to surface algorithm vulnerabilities, weak secrets, and missing validations.